Pin GitHub Actions to SHAs [SRE-1802]

[tylergohl]

Summary

Pin GitHub Actions references in this repo to immutable commit SHAs (with the original tag/branch preserved in a trailing comment). Part of SRE-1802 — org-wide supply-chain hardening.

Scope

This PR pins:

• Internal ctrliq/* reusable workflow and action references
• External actions not handled by clo-ciq's parallel Node 20 effort

No actions in this repo were claimed by clo-ciq's effort — this PR pins everything.

Files touched

• .github/workflows/release.yml

Test plan

• Workflow runs succeed on this branch (or on next trigger after merge)
• Once this and any companion clo-ciq PR merge, this repo has zero unpinned external/internal refs and sha_pinning_required can be enabled on it

[ciq-it-service-account]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

Supply chain hardening for the repo’s release workflow by pinning GitHub Actions uses: references to immutable commit SHAs as part of SRE-1802.

Changes:

• Pinned actions/setup-python to a commit SHA (with a # v2 comment retained).
• Pinned actions/checkout to a commit SHA (with a # v2 comment retained).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.