fix(ci): pin third-party actions to full commit SHAs (#127)

fix(ci): pin third-party actions to full commit SHAs

The account's Actions policy requires a full-length SHA ref. A tag or
branch ref is refused at
startup — `startup_failure`, no jobs, "this workflow graph cannot be
shown" — so these workflows
could not run at all. This resolves each ref to the commit it currently
points at and records the
ref in a trailing comment, e.g. `actions/checkout@<sha> # v4`.

`dtolnay/rust-toolchain` takes its toolchain from the ref itself, so
those steps also gained an
explicit `with: toolchain:` input; without it, a SHA ref would silently
lose the channel.

No behaviour is intended to change beyond the pins.

Author: hyperpolymath

.github/workflows/main-estate-audit.yml

@@ -10,82 +10,82 @@ jobs:
   estate-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
 
       - name: Required Files Gate
-        uses: hyperpolymath/cicd-suite/actions/required-files-check@main
+        uses: hyperpolymath/cicd-suite/actions/required-files-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Code Hygiene Gate
-        uses: hyperpolymath/cicd-suite/actions/code-hygiene-check@main
+        uses: hyperpolymath/cicd-suite/actions/code-hygiene-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Manifest Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/manifest-check@main
+        uses: hyperpolymath/cicd-suite/actions/manifest-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Idris2 ABI Purity Gate
-        uses: hyperpolymath/cicd-suite/actions/idris2-abi-check@main
+        uses: hyperpolymath/cicd-suite/actions/idris2-abi-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Zig Hexadeca API Gate
-        uses: hyperpolymath/cicd-suite/actions/zig-hexadeca-check@main
+        uses: hyperpolymath/cicd-suite/actions/zig-hexadeca-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Contractile Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/contractile-validation-check@main
+        uses: hyperpolymath/cicd-suite/actions/contractile-validation-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Recipes Set Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/recipes-set-check@main
+        uses: hyperpolymath/cicd-suite/actions/recipes-set-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Affirmation Document Gate
-        uses: hyperpolymath/cicd-suite/actions/affirmation-check@main
+        uses: hyperpolymath/cicd-suite/actions/affirmation-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Academic Referencing Gate
-        uses: hyperpolymath/cicd-suite/actions/referencing-check@main
+        uses: hyperpolymath/cicd-suite/actions/referencing-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Semantic Audit Gate
-        uses: hyperpolymath/cicd-suite/actions/semantic-audit-check@main
+        uses: hyperpolymath/cicd-suite/actions/semantic-audit-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: SPDX License Gate
-        uses: hyperpolymath/cicd-suite/actions/spdx-license-check@main
+        uses: hyperpolymath/cicd-suite/actions/spdx-license-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Proof Runner Gate
-        uses: hyperpolymath/cicd-suite/actions/proof-runner-check@main
+        uses: hyperpolymath/cicd-suite/actions/proof-runner-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: PRAT Testing Gate
-        uses: hyperpolymath/cicd-suite/actions/prat-check@main
+        uses: hyperpolymath/cicd-suite/actions/prat-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Panic Attack & Pons Gate
-        uses: hyperpolymath/cicd-suite/actions/custom-tools-check@main
+        uses: hyperpolymath/cicd-suite/actions/custom-tools-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: WWW & Well-Known Compliance Gate
-        uses: hyperpolymath/cicd-suite/actions/www-compliance-check@main
+        uses: hyperpolymath/cicd-suite/actions/www-compliance-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: BoJ Cartridge Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/boj-cartridge-check@main
+        uses: hyperpolymath/cicd-suite/actions/boj-cartridge-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Formatting Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/formatting-check@main
+        uses: hyperpolymath/cicd-suite/actions/formatting-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Accreditations & Badges Gate
-        uses: hyperpolymath/cicd-suite/actions/badges-check@main
+        uses: hyperpolymath/cicd-suite/actions/badges-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Metrics Extraction Gate
-        uses: hyperpolymath/cicd-suite/actions/metrics-check@main
+        uses: hyperpolymath/cicd-suite/actions/metrics-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Linguist & Banned Languages Gate
-        uses: hyperpolymath/cicd-suite/actions/linguist-check@main
+        uses: hyperpolymath/cicd-suite/actions/linguist-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Test & Benchmarks Dashboard Gate
-        uses: hyperpolymath/cicd-suite/actions/tests-benches-check@main
+        uses: hyperpolymath/cicd-suite/actions/tests-benches-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Hosting & Site Status Gate
-        uses: hyperpolymath/cicd-suite/actions/hosting-check@main
+        uses: hyperpolymath/cicd-suite/actions/hosting-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Git-Sea Analytics Gate
-        uses: hyperpolymath/cicd-suite/actions/gitsea-check@main
+        uses: hyperpolymath/cicd-suite/actions/gitsea-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Trust & Humans Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/trust-humans-check@main
+        uses: hyperpolymath/cicd-suite/actions/trust-humans-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Are We UnAPI Gate (Secret Scanning)
-        uses: hyperpolymath/cicd-suite/actions/secrets-check@main
+        uses: hyperpolymath/cicd-suite/actions/secrets-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main
 
       - name: Reasonably Good Token Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/vaulted-tokens-check@main
+        uses: hyperpolymath/cicd-suite/actions/vaulted-tokens-check@180b419825d238f8b606584c970a81dfa7cb6f81  # main