chore(ci): pin actions to immutable commit SHAs

[yordis]

• Mutable tags let an upstream maintainer change what runs here after the fact, and pinning is a prerequisite for turning on the organization SHA pinning policy without taking CI down.

[cursor]

PR Summary

Low Risk
CI-only workflow reference updates with no application or publish logic changes; pinned SHAs correspond to the prior tagged action versions.

Overview
Replaces mutable version tags on third-party GitHub Actions with full commit SHAs (with # vX.Y.Z comments) across the Client, Publish, and Integration Tests workflows.

dotnet.yml, test.yml, and publish.yml now pin actions/checkout, actions/setup-dotnet, and—where used—actions/upload-artifact, actions/download-artifact, and docker/login-action. Runtime behavior should match the previously referenced major/minor tags; the change is about supply-chain immutability and aligning with org SHA pinning policy, not altering build or test steps.

^{Reviewed by Cursor Bugbot for commit df2e117. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 44 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: d8601145-c35a-4175-b34e-b3fb89b74c82

📥 Commits

Reviewing files that changed from the base of the PR and between 6375cbc and df2e117.

📒 Files selected for processing (3)

• .github/workflows/dotnet.yml
• .github/workflows/publish.yml
• .github/workflows/test.yml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 9bff3ed4-f5f4-48fd-8682-03eff80b6c71

📥 Commits

Reviewing files that changed from the base of the PR and between c59f1ee and 6375cbc.

📒 Files selected for processing (3)

• .github/workflows/dotnet.yml
• .github/workflows/publish.yml
• .github/workflows/test.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The workflows now pin GitHub Actions to specific commit SHAs. Version comments identify the corresponding action releases. Workflow logic, inputs, and step behavior remain unchanged.

Changes

Workflow action pinning

Layer / File(s)	Summary
Pin workflow actions to commits .github/workflows/dotnet.yml, .github/workflows/publish.yml, .github/workflows/test.yml	The workflows replace mutable action tags with commit SHA references and version comments for checkout, .NET setup, artifact transfer, and Docker login actions.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 6375c

The PR pins CI actions to immutable commit SHAs without changing workflow behavior; no actionable merge-blocking risk remains after normal checks and review.

Poem

A rabbit pins each action tight,
SHA markers guide the workflow right,
Checkout follows a fixed trail,
Dotnet steps remain stable,
Artifacts move without surprise,
The rabbit hops beneath clear skies.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning CI actions to immutable commit SHAs.
Description check	✅ Passed	The description explains why the workflows pin actions to immutable commit SHAs and directly matches the changeset objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch yordis/chore-pin-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}