Pin GitHub Actions to commit SHAs for security

[sugyan]

Summary

• Pin all GitHub Actions to specific commit SHAs instead of version tags for improved supply chain security
• Prevents potential security issues from tag manipulation or compromised action versions
• All pinned versions include comments with the semantic version for maintainability

Changes

Updated the following actions across 12 workflow files:

• actions/checkout: v4 → v4.3.0 (SHA: 08eba0b)
• Swatinem/rust-cache: v2 → v2.7.3 (SHA: 82a92a6)
• actions/upload-artifact: v4 → v4.4.3 (SHA: 80b2bf3)
• actions-rust-lang/setup-rust-toolchain: v1 → v1.15.1 (SHA: 02be93d)
• giraffate/clippy-action: v1 → v1.0.1 (SHA: 13b9d32)
• release-plz/action: v0.5 → v0.5.117 (SHA: acb9246)

Test plan

• Verify all workflows still pass with pinned versions
• Check that actions behave identically to tag-based versions

🤖 Generated with Claude Code

[Copilot]

Pull Request Overview

This PR enhances supply chain security by pinning all GitHub Actions to specific commit SHAs instead of version tags, preventing potential security issues from tag manipulation or compromised action versions.

• Replaces version tags with commit SHAs for 6 different GitHub Actions
• Adds semantic version comments for maintainability
• Updates 12 workflow files across the repository

Reviewed Changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/xrpc.yml	Pin actions/checkout to commit SHA
.github/workflows/xrpc-client.yml	Pin actions/checkout to commit SHA
.github/workflows/wasm.yml	Pin actions/checkout and actions-rust-lang/setup-rust-toolchain to commit SHAs
.github/workflows/rust.yml	Pin actions/checkout, actions-rust-lang/setup-rust-toolchain, and giraffate/clippy-action to commit SHAs
.github/workflows/repo.yml	Pin actions/checkout to commit SHA
.github/workflows/release-plz.yml	Pin actions/checkout and release-plz/action to commit SHAs
.github/workflows/oauth.yml	Pin actions/checkout to commit SHA
.github/workflows/identity.yml	Pin actions/checkout to commit SHA
.github/workflows/crypto.yml	Pin actions/checkout to commit SHA
.github/workflows/common.yml	Pin actions/checkout to commit SHA
.github/workflows/bsky-sdk.yml	Pin actions/checkout to commit SHA
.github/workflows/api.yml	Pin actions/checkout to commit SHA

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}