chore(ci): pin all GitHub Actions to SHA digests

[fcanogab]

Summary

Replace all mutable version tag references across 23 workflow files with
immutable SHA digests. Pinning to immutable SHAs eliminates the risk of a
compromised or reassigned upstream tag injecting malicious code into CI runs.
Dependabot (configured in #1188) will keep these pins current automatically.

Related Issue

N/A

Changes

• Pin actions/checkout@v6 → de0fac2e4500dabe0009e67214ff5f5447ce83dd
• Pin actions/checkout@v4 → 34e114876b0b11c390a56381ad16ebd13914f8d5
• Pin actions/github-script@v9 → 373c709c69115d41ff229c7e5df9f8788daa9553
• Pin actions/setup-node@v6 → 48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
• Pin docker/login-action@v4 → 4907a6ddec9925e35a0a9e82d7399ccc52663121
• Pin actions/upload-artifact@v7 → 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• Pin actions/download-artifact@v4 → d3f86a106a0bac45b974a628896c90dbdf5c8093
• Pin softprops/action-gh-release@v2 → 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65
• Pin actions/attest@v4 → 281a49d4cbb0a72c9575a50d18f6deb515a11deb
• Retain the version tag as an inline comment on each line for human readability and because it's a Dependabot requirement

Testing

• mise run pre-commit passes (lint, format, license headers, rust:check, rust:lint)
• Unit tests added/updated — not applicable
• E2E tests added/updated — not applicable

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated — not applicable

Made with Cursor

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[TaylorMutch]

LGTM if you can fix the merge conflicts

[russellb]

It would be nice to look at configuring Dependabot to propose bumps to these. Previously, using something like v6 would have gotten minor updates/fixes automatically, but we'll need to update now.

100% supportive of this change as a best practice, by the way!

I'm happy to propose the bot config after this lands unless there's an objection. (Obviously, those bot updates need to be checked and not blindly merged, or it defeats the purpose.)

[TaylorMutch]

It would be nice to look at configuring Dependabot to propose bumps to these. Previously, using something like v6 would have gotten minor updates/fixes automatically, but we'll need to update now.

100% supportive of this change as a best practice, by the way!

I'm happy to propose the bot config after this lands unless there's an objection. (Obviously, those bot updates need to be checked and not blindly merged, or it defeats the purpose.)

No concerns on my front, seems fine to me