ci: pin GitHub Actions to commit SHAs (7)

[mirkosalvato1-ctrl]

Why

Mutable Action tags (@v4, @main) can be retagged, which is a supply-chain risk.
This PR pins third-party Actions to full commit SHAs while keeping the tag in a comment.
Official actions/* tags are left unchanged (common maintainer preference).

Pins

• pnpm/action-setup@v6 -> 0ebf47130e48
• azure/trusted-signing-action@v2 -> c7ab2a863ab5
• docker/setup-buildx-action@v4 -> bb05f3f5519d
• docker/login-action@v4 -> af1e73f918a0
• docker/metadata-action@v6 -> dc8028041006
• docker/build-push-action@v7 -> 53b7df96c91f
• pnpm/action-setup@v6 -> 0ebf47130e48

Reference: GitHub docs on using third-party actions securely.

Summary by CodeRabbit

• Chores
  • Updated automated build, test, signing, and Docker publishing workflows to use fixed versions of their actions.
  • Improved CI/CD reliability and reproducibility without changing build, test, packaging, or publishing behavior.

[vercel]

@mirkosalvato1-ctrl is attempting to deploy a commit to the HackerAI Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 77352c51-28da-4d54-9411-db5abd49e764

📥 Commits

Reviewing files that changed from the base of the PR and between 5fa19ea and 2928760.

📒 Files selected for processing (3)

• .github/workflows/desktop-build.yml
• .github/workflows/docker-sandbox.yml
• .github/workflows/test.yml

---

📝 Walkthrough

Walkthrough

Changes

GitHub Actions pinning

Layer / File(s)	Summary
Desktop and test workflow pinning .github/workflows/desktop-build.yml, .github/workflows/test.yml	pnpm setup and Azure Trusted Signing action references now use commit SHAs instead of version tags.
Docker workflow pinning .github/workflows/docker-sandbox.yml	Buildx, registry login, metadata, and image build action references now use commit SHAs instead of version tags.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: ross0x01

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: pinning GitHub Actions to commit SHAs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/desktop-build.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/docker-sandbox.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/test.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}