chore(ci): pin all GitHub Actions to full SHA digests

Replace mutable version tags (e.g. @v4) with immutable full-length
commit SHA digests across all seven workflow files. Each pin retains
a human-readable comment (e.g. # v4) so the intended version is still
obvious at a glance.

Actions pinned:
- actions/checkout@v4          → @11bd71901bbe5b1630ceea73d27597364c9af683
- actions/setup-node@v4        → @49933ea5288caeca8642d1e84afbd3f7d6820020
- actions/cache@v4             → @0057852bfaa89a56745cba8c7296529d2fc39830
- actions/github-script@v7     → @f28e40c7f34bde8b3046d885e986cb6290c5673b
- actions/dependency-review-action@v4 → @a6993e2c61fd5dc440b409aa1d6904921c5e1894
- dtolnay/rust-toolchain@stable → @3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
- Swatinem/rust-cache@v2       → @42dc69e1aa15d09112580998cf2ef0119e2e91ae

Workflows updated:
- abi-snapshot.yml
- audit-check.yml
- changelog.yml
- ci.yml
- commitlint.yml
- contract-release.yml
- dependency-review.yml

Also fixes a structural bug in audit-check.yml where the frontend-audit
step was missing its step name and was incorrectly appended to the
backend-audit step block.

Author: josunday002

.github/workflows/abi-snapshot.yml

@@ -20,15 +20,15 @@ jobs:
         working-directory: contract
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
         with:
           targets: wasm32-unknown-unknown
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
         with:
           workspaces: contract
 

.github/workflows/audit-check.yml

@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: 📥 Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: 🟢 Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"
 
@@ -58,6 +58,8 @@ jobs:
             echo "::error::High vulnerabilities in backend: $HIGH"
             exit 1
           fi
+
+      - name: 📦 Check frontend audits
         id: frontend-audit
         working-directory: ./frontend
         run: |
@@ -89,9 +91,11 @@ jobs:
             echo "❌ **HIGH vulnerabilities detected**" >> $GITHUB_STEP_SUMMARY
             echo "::error::High vulnerabilities in frontend: $HIGH"
             exit 1
-          fi with audit summary
+          fi
+
+      - name: 💬 Comment on PR with audit summary
         if: github.event_name == 'pull_request' && always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: >-

.github/workflows/changelog.yml

@@ -16,13 +16,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '20'
 

.github/workflows/ci.yml

@@ -48,9 +48,9 @@ jobs:
       SOROBAN_RPC_URL: https://soroban-testnet.stellar.org
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ matrix.node }}
           cache: 'npm'
@@ -102,9 +102,9 @@ jobs:
       NODE_ENV: test
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '20'
           cache: 'npm'
@@ -143,9 +143,9 @@ jobs:
         node: ['20', '22']
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ matrix.node }}
           cache: 'npm'
@@ -198,9 +198,9 @@ jobs:
       NODE_ENV: test
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '20'
           cache: 'npm'
@@ -226,10 +226,10 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Cache Cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             ~/.cargo/registry/index
@@ -241,7 +241,7 @@ jobs:
             ${{ runner.os }}-cargo-registry-
 
       - name: Cache Cargo target directory
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: contract/target
           key: ${{ runner.os }}-contract-target-${{ hashFiles('contract/**/Cargo.lock') }}
@@ -266,4 +266,4 @@ jobs:
 
       - name: Build
         run: cargo build --release
-        working-directory: contract
+        working-directory: contract

.github/workflows/commitlint.yml

@@ -10,12 +10,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '20'
 

.github/workflows/contract-release.yml

@@ -26,10 +26,10 @@ jobs:
 
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: 🦀 Cache Cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             ~/.cargo/registry/index
@@ -41,7 +41,7 @@ jobs:
             ${{ runner.os }}-cargo-registry-
 
       - name: 🏗️ Cache Cargo target
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: contract/target
           key: ${{ runner.os }}-contract-target-${{ hashFiles('contract/Cargo.lock') }}
@@ -211,7 +211,7 @@ jobs:
 
       - name: 📝 Comment on PR with checklist summary
         if: github.event_name == 'pull_request' && always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/dependency-review.yml

@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@a6993e2c61fd5dc440b409aa1d6904921c5e1894 # v4