[Infra] Pin workflow actions to commit SHAs and audit movable refs

[DongyuZhao]

Summary

• Every uses: reference across the five workflows (ci, codeql, release, release-dry-run, pr-metrics-comment) is now pinned to a full commit SHA with the release version recorded in a trailing comment. A movable major tag lets a tag replacement change the code that CI and release jobs execute without a reviewed diff; the SHA makes the executed bytes part of the reviewed history.
• audit-ci-policy.sh (run as audit:ci in the repository health check) now rejects any workflow action reference that is not a 40-hex commit SHA, so a future workflow edit cannot quietly reintroduce a movable ref. Local uses: ./… references stay exempt.
• Every SHA↔version pair was verified against the GitHub API (repos/<action>/commits/<tag>) before landing; the pins match the ones tex-core reviewed.
• Ported from tex-core ([Engine/Bindings/Release/CI] Close the independent M1 exit audit (#29–#69) tex-core#70), the same direction as [Release] Refresh Maven checksum sidecars after the publication merge #36/[Infra] Preserve benchmark failures through the metrics tee #37/[Infra] Pin squash-only merges with PR-title messages in bootstrap #39/[Infra] Default bootstrap to active enforcement and fail closed on ruleset downgrades #65.
• No CHANGELOG entry: markdown-core's changelog records release changes only, matching the previous mirrors.

Verification

audit:ci green on the pinned tree; negative test confirmed the new check fails with a pointed message when a single ref is reverted to @v7.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c7ab965bf3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

PR performance and binary-size diff

Benchmark execution is required; hosted-runner timing, memory, and size deltas are informational only.

Baseline: exact PR base 384e8a744487 (successful main CI).

Performance

Runtime	Workload	Median	Perf diff	Memory	Memory diff
c	representative_large	6.294 ms	⚠️ +20.6%	8,592 KiB	✅ -0.7%
es	deep_nesting	0.304 ms	⚠️ +4.9%	131,588 KiB	✅ -12.1%
es	large_document	32.612 ms	✅ -2.1%	131,588 KiB	✅ -12.1%
kotlin	deep_nesting	0.279 ms	⚠️ +14.2%	97,548 KiB	✅ -5.7%
kotlin	large_document	23.289 ms	✅ -29.7%	95,056 KiB	✅ -6.8%
swift	deep_nesting	0.074 ms	✅ -7.9%	26,080 KiB	✅ +0.2%
swift	large_document	9.898 ms	✅ -55.2%	25,904 KiB	✅ -0.3%

Binary size

Artifact	Bytes	KiB	Size diff
c-shared-library	501,888	490.1	✅ 0 B (0.0%)
es-wasm	288,573	281.8	✅ 0 B (0.0%)
kotlin-jvm-jar	312,972	305.6	✅ 0 B (0.0%)

Head CI run

Size deltas are deterministic for identical build inputs. Performance deltas compare separate hosted runners and should be treated as directional evidence, not a pass/fail threshold.