chore: Pin GitHub Actions

[gjtorikian]

Summary

Pin all third-party GitHub Actions to immutable commit SHAs.

Why

Action tags (like v3, v4, main) can be moved or retagged, which means a future workflow run could execute different code than what we reviewed today. Pinning to SHAs makes the workflow supply chain deterministic and auditable, reducing the risk of action-level compromise or accidental breaking changes. We can still update intentionally by bumping the SHA.

[greptile-apps]

Greptile Summary

Pins all third-party GitHub Actions to immutable commit SHAs to improve supply chain security and auditability.

• Replaces tag-based references (v4, v6, v8) with full commit SHAs
• Includes version comments (e.g., # v6.0.2) for maintainability
• Covers 5 actions across 3 workflow files: actions/checkout, actions/cache, actions/create-github-app-token, softprops/action-gh-release, and peter-evans/create-pull-request
• Correctly leaves shivammathur/setup-php unchanged as it was already pinned

Confidence Score: 5/5

• This PR is safe to merge with no risk
• All changes are configuration-only, pinning GitHub Actions to SHAs is a security best practice, no logic changes, and all SHAs are properly formatted with version comments
• No files require special attention

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Pinned actions/checkout and actions/cache to immutable SHAs with version comments
.github/workflows/release.yml	Pinned actions/create-github-app-token, actions/checkout, and softprops/action-gh-release to SHAs
.github/workflows/version-bump.yml	Pinned actions/create-github-app-token, actions/checkout, and peter-evans/create-pull-request to SHAs

_{Last reviewed commit: d9b7d01}

[greptile-apps]

_{3 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[gjtorikian]

Ah, thanks @mthadley, but you're not a member of the PHP team, so it won't unlock here. Don't you want to join it? Doesn't it sound like fun?

[mthadley]

Ah, thanks @mthadley, but you're not a member of the PHP team, so it won't unlock here. Don't you want to join it? Doesn't it sound like fun?

I don't see why not! I'm already a member of nearly every other SDK team. 😆