chore: pin GitHub Actions to commit SHAs

[compojoom]

What it solves

GitHub Actions referenced by mutable tags (e.g. @v3) can be silently re-pointed by a tag move, which is a supply-chain risk. GitHub itself recommends pinning third-party (and first-party) actions to a full commit SHA.

How this PR fixes it

Replaced every uses: owner/action@vX reference across all four workflow files with uses: owner/action@<full-sha> # <exact-version>. The trailing comment records the exact released tag the SHA corresponds to (e.g. v3.6.0, v3.9.1) rather than the floating major (v3), so future updates are explicit.

Actions pinned:

• actions/checkout → f43a0e5ff2bd294095638e18286ca9a3d1956744 (v3.6.0)
• actions/setup-node → 3235b876344d2a9aa001b8d1453c930bba69e610 (v3.9.1)
• contributor-assistant/github-action → b2a7f9fb90217ea0b8a0c95c288221457be4a31f (v2.2.0)
• gnosis/changesets-action-github-releases → 0c10ec15081f104b1ce721beadafddb9d2880336 (v1.2.0)

No behavioral change — the SHAs resolve to the same versions previously in use.

How to test it

1. Open the Actions tab on this PR and confirm the Test and ESLint check workflows run and pass.
2. Inspect the workflow run logs to confirm each action resolves to the pinned SHA (the version comment matches).
3. Verify the CLA workflow is triggered on this PR (it uses the pinned contributor-assistant/github-action).

Screenshots

N/A - no UI changes

Checklist

• I've tested the branch on mobile 📱
• I've documented how it affects the analytics (if at all) 📊
• I've written a unit/e2e test for it (if applicable) 🧑‍💻

---

CLA signature

With the submission of this Pull Request, I confirm that I have read and agree to the terms of the Contributor License Agreement.

[changeset-bot]

⚠️ No Changeset found

Latest commit: b489926

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR