ci: pin GitHub Actions to commit SHA, not mutable tags

[jamesarich]

Summary

Org-level sha_pinning_required is off, so all four actions in githubci.yml were pinned to floating tags - a supply-chain risk (a compromised or hijacked tag moves without the workflow file changing). Pinned each to the exact commit its current tag resolves to; no functional or version change:

Action	Tag	Resolved to
actions/checkout	v4	v4.4.0
actions/upload-artifact	v4	v4.6.2
carlosperate/arm-none-eabi-gcc-action	v1	v1.13.0
softprops/action-gh-release	v1	v1 (no semver tag exists on this repo's v1 line)

Added helpers:pinGitHubActionDigests to renovate.json (#7) so future version bumps keep the pin-with-comment format instead of reverting to a floating tag.

Test plan

• yq eval '.' .github/workflows/githubci.yml - valid YAML
• jq . renovate.json - valid JSON
• Each SHA verified as the actual commit its tag currently resolves to (dereferencing annotated tags where needed, not just trusting the ref object blindly)

[coderabbitai]

Warning

Review limit reached

@jamesarich, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 41 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1cd489cd-dd70-4f16-b061-321d6b3e6e89

📥 Commits

Reviewing files that changed from the base of the PR and between 66194f3 and 97b4f93.

📒 Files selected for processing (2)

• .github/workflows/githubci.yml
• renovate.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}