fix: pin 5 unpinned action(s),extract 4 unsafe expression(s) to env vars

[dagecko]

This is a re-submission of #1869, which was closed due to a branch issue on my end. Same fixes, apologies for the noise.

Security: Harden GitHub Actions workflows

Hey, I found some CI/CD security issues in this repo's GitHub Actions workflows. These are the same vulnerability classes that were exploited in the tj-actions/changed-files supply chain attack. I've been reviewing repos that are affected and submitting fixes where I can.

This PR applies mechanical fixes and flags anything else that needs a manual look. Happy to answer any questions.

Fixes applied

Rule	Severity	File	Description
RGS-007	high	.github/workflows/docker-release.yml	Pinned 3 third-party action(s) to commit SHA
RGS-007	high	.github/workflows/main.yml	Pinned 1 third-party action(s) to commit SHA
RGS-002	high	.github/workflows/main.yml	Extracted 4 unsafe expression(s) to env vars
RGS-007	high	.github/workflows/release.yml	Pinned 1 third-party action(s) to commit SHA

Additional findings (manual review recommended)

| Rule | Severity | File | Description |
| RGS-004 | high | .github/workflows/main.yml | Comment-Triggered Workflow Without Author Authorization Check |
| RGS-004 | high | .github/workflows/main.yml | Comment-Triggered Workflow Without Author Authorization Check |
| RGS-004 | high | .github/workflows/main.yml | Comment-Triggered Workflow Without Author Authorization Check |

Why this matters

GitHub Actions workflows that use untrusted input in run: blocks or reference unpinned third-party actions are vulnerable to code injection and supply chain attacks. These are the same vulnerability classes exploited in the tj-actions/changed-files incident which compromised CI secrets across thousands of repositories.

How to verify

Review the diff, each change is mechanical and preserves workflow behavior:

• Expression extraction: Moves ${{ }} expressions from run: blocks into env: mappings, preventing shell injection
• SHA pinning: Pins third-party actions to immutable commit SHAs (original version tag preserved as comment)

---

If this PR is not welcome, just close it and I won't send another.