fix: pin 7 unpinned action(s), extract 1 inline secret to env var (#5439)

Re-submission of #5422. Had a problem with my fork and had to delete it,
which closed the original PR. Apologies for the noise.

## Summary

This PR pins all GitHub Actions to immutable commit SHAs and extracts an
inline secret from a `run:` block into an `env:` mapping.

- Pin 7 unpinned actions to full 40-character SHAs
- Extract 1 inline secret from run block to env var

## How to verify

Review the diff, each change is mechanical and preserves workflow
behavior:
- **SHA pinning**: `action@v3` becomes `action@abc123 # v3`, original
version preserved as comment
- **Secret extraction**: `${{ secrets.* }}` in `run:` moves to `env:`
block, referenced as `"${ENV_VAR}"` in the script
- No workflow logic, triggers, or permissions are modified

I've been researching CI/CD supply chain attack vectors and submitting
fixes to affected repos. Based on that research I built a scanner called
Runner Guard and open sourced it
[here](https://github.com/Vigilant-LLC/runner-guard) so you can scan
yourself if you want to. I'll be posting more advisories over the next
few weeks [on Twitter](https://x.com/vigilance_one) if you want to stay
in the loop.

If you have any questions, reach out. I'll be monitoring comms.

\- Chris (dagecko)

.github/workflows/check-required-label.yml

@@ -8,7 +8,7 @@ jobs:
   check-required-label:
     runs-on: ubuntu-latest
     steps:
-      - uses: mheap/github-action-required-labels@v5
+      - uses: mheap/github-action-required-labels@0ac283b4e65c1fb28ce6079dea5546ceca98ccbe # v5
         with:
           mode: exactly
           count: 1

.github/workflows/ci.yml

@@ -168,7 +168,7 @@ jobs:
         with:
           go-version: 1.25.x
       - name: Lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9
         with:
           # If you change this, make sure to also update scripts/golangci-lint-shim.sh
           version: v2.4.0
@@ -206,10 +206,12 @@ jobs:
 
       - name: Upload to Codacy
         run: |
-          CODACY_PROJECT_TOKEN=${{ secrets.CODACY_PROJECT_TOKEN }} \
+          CODACY_PROJECT_TOKEN="${CODACY_PROJECT_TOKEN}" \
             bash <(curl -Ls https://coverage.codacy.com/get.sh) report \
             --force-coverage-parser go -r coverage.out
 
+        env:
+          CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
   check-for-fixups:
     runs-on: ubuntu-latest
     if: github.ref != 'refs/heads/master'

.github/workflows/codespell.yml

@@ -20,6 +20,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
       - name: Annotate locations with typos
-        uses: codespell-project/codespell-problem-matcher@v1
+        uses: codespell-project/codespell-problem-matcher@9ba2c57125d4908eade4308f32c4ff814c184633 # v1.2.0
       - name: Codespell
-        uses: codespell-project/actions-codespell@v2
+        uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # v2.2

.github/workflows/release.yml

@@ -152,7 +152,7 @@ jobs:
           go-version: 1.25.x
 
       - name: Run goreleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
         with:
           distribution: goreleaser
           version: v2

.github/workflows/sponsors.yml

@@ -13,13 +13,13 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Generate Sponsors 💖
-        uses: JamesIves/github-sponsors-readme-action@v1.2.2
+        uses: JamesIves/github-sponsors-readme-action@2fd9142e765f755780202122261dc85e78459405 # v1.6.0
         with:
           token: ${{ secrets.SPONSORS_TOKEN }}
           file: "README.md"
 
       - name: Create Pull Request 🚀
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
         with:
           commit-message: "README.md: Update Sponsors"
           title: "README.md: Update Sponsors"