chore: pin actions to commit SHAs

[schnellert]

Closes #9

[Copilot]

Pull request overview

Pins GitHub Actions used by CI and release workflows to immutable commit SHAs to improve supply-chain security and build reproducibility.

Changes:

• Replaces tag-based uses: ...@v* references with commit-SHA pins across CI and release workflows.
• Updates action references to specific SHAs, with inline comments indicating the corresponding action release versions.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/release.yml	Pins checkout/setup-go/release/Docker actions to commit SHAs in the release pipeline.
.github/workflows/ci.yml	Pins checkout/setup-go/Docker actions to commit SHAs in the CI pipeline.

Suppressed comments (1)

.github/workflows/release.yml:115

• This PR is titled as a SHA pinning change, but this step also bumps the action from v2 to v3 (major upgrade). Major versions can include breaking changes; either pin the commit for the existing v2 major line, or update the PR title/notes to explicitly call out the upgrade and validate the workflow still behaves as expected.

      - name: Upload checksums
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          files: dist/checksums.txt

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.