chore(security): update github actions and pin to commit sha

[gameroman]

What Changed

Update github actions and pin to commit SHA

Why

Read more at https://e18e.dev/docs/publishing.html#keeping-actions-up-to-date

Checklist

• This PR is small and focused
• I explained what changed and why

Note

Pin all GitHub Actions to specific commit SHAs across CI workflows

Replaces floating version tags (e.g. @v6, @v2) with pinned commit SHAs across all workflow files, with version annotations in comments. Affected workflows include ci.yml, release.yml, pr-vouch.yml, pr-size.yml, and issue-labels.yml. The release workflow also picks up version bumps for several actions, including actions/create-github-app-token (v2 → v3.0.0) and actions/download-artifact (v7 → v8.0.1).

^{Macroscope summarized 871304d.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 70fe98e1-f055-480f-b0f6-0cb5800fb6ed

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}