Pin GitHub Action to SHA

[sobhe-Starkware]

Type

• feature
• bugfix
• dev (no functional changes, no API changes)
• fmt (formatting, renaming)
• build
• docs
• testing

Description

Breaking changes?

• yes
• no

---

This change is 

[cursor]

PR Summary

Low Risk
Workflow-only change with no application logic; pinning SHAs reduces tag-mutation risk and should not alter CI behavior if the SHAs match the prior tags.

Overview
Replaces floating version tags (e.g. @v4, @v2) on third-party GitHub Actions with immutable commit SHAs, each annotated with the intended release tag in a comment.

Coverage spans the main CI workflow (check.yml), PR merge gatekeeper, artifact upload to GCS (including the composite build-arch-binary action), and actions such as actions/checkout, dtolnay/rust-toolchain, Swatinem/rust-cache, Google Cloud auth/upload, taiki-e/install-action, codecov, and merge-gatekeeper.

No job steps, inputs, or build/test commands are changed—only which exact action revision runs.

^{Reviewed by Cursor Bugbot for commit 056cfcd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.86%. Comparing base (4c777d3) to head (056cfcd).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #411   +/-   ##
=======================================
  Coverage   67.86%   67.86%           
=======================================
  Files          42       42           
  Lines        5459     5459           
=======================================
  Hits         3705     3705           
  Misses       1754     1754           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[phil-starkware]

@phil-starkware reviewed 4 files and all commit messages, and made 1 comment.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on sobhe-Starkware).