ci: check out release tag and use action version tags

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Snailedlt

.github/workflows/npm_publish.yml

@@ -13,16 +13,15 @@ jobs:
       id-token: write # Required for npm trusted publishing (OIDC)
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
-          # "ref" specifies the branch to check out.
-          # "github.event.release.target_commitish" is a global variable and specifies the branch the release targeted
-          # It's empty on manual runs, so the branch selected in the Actions tab is used instead
-          ref: ${{ github.event.release.target_commitish }}
+          # Check out the release tag for release events.
+          # For manual runs, use the branch or tag selected in the Actions tab.
+          ref: ${{ github.event_name == 'release' && github.event.release.tag_name || github.ref }}
           persist-credentials: false
       # Node 24 ships with npm 11.5.1 or later, which trusted publishing requires
       - name: Use Node.js v24
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        uses: actions/setup-node@v7
         with:
           node-version: 24
           package-manager-cache: false