GitHub Actions tag references (@v4, @main) are mutable, pin to the full 40-character commit SHA instead

Action tags are git tags and can be silently retargeted. A compromised maintainer can repoint @v4 at a malicious commit and every consumer pulls it on the next run. GitHub added an org/enterprise policy 'Require actions to be pinned to a full-length commit SHA' in 2025-08 that blocks tag-style references; Dependabot understands SHA-pinned actions and opens PRs updating the SHA while preserving the human-readable version in a trailing comment.

Replace uses: actions/checkout@v4 with uses: actions/checkout@<40-char-sha> # v4.x.y. At org level, enable the SHA-pinning policy. Verify the current policy name and Dependabot behavior in GitHub's docs, both shipped recently and are still evolving.