Harden CI: pin ci.yml actions to commit SHAs

[vivekchand]

Addresses the Scorecard PinnedDependencies findings for ci.yml, the repo's most-run workflow.

What this does

Every third-party action referenced by .github/workflows/ci.yml — and by the setup-openclaw composite action that ci.yml calls — now resolves to a full 40-character commit SHA, with the semver it came from in a trailing comment:

Action	Pinned to	Version
actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	v7.0.1 (×13)
actions/setup-python	5fda3b95a4ea91299a34e894583c3862153e4b97	v7.0.0 (×13)
actions/upload-artifact	043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	v7.0.1 (×3)
actions/setup-node	820762786026740c76f36085b0efc47a31fe5020	v7.0.0
actions/cache	55cc8345863c7cc4c66a329aec7e433d2d1c52a9	v6.1.0
actions/setup-node (composite)	49933ea5288caeca8642d1e84afbd3f7d6820020	v4.4.0
actions/cache (composite)	0057852bfaa89a56745cba8c7296529d2fc39830	v4.3.0

Why

A version tag is mutable. actions/checkout@v7 is whatever v7 points at the next time a runner resolves it, so an upstream maintainer — or anyone who takes over that account — can change the code running in our CI without any commit landing in this repo. A commit SHA cannot be moved, so what runs in CI is fixed by this repository's own history.

Scope

Pins only, no version changes. Each action was pinned to wherever its current major tag points today. The two actions inside the composite stay on their v4 majors rather than being pulled up to v7 — this PR is a supply-chain fix, not an upgrade, and mixing the two would make it harder to bisect if CI moved.

.github/dependabot.yml already covers the github-actions ecosystem, so Dependabot continues to propose upgrades and will bump the SHA and the version comment together.

Verification

• All 35 workflow and composite-action files parse: python3 -c "import yaml,glob; [yaml.safe_load(open(f)) for f in glob.glob('.github/workflows/*.yml')]" — OK.
• The diff is 33 insertions / 33 deletions and every changed line is a uses: line; no structural, permission, or job changes.
• No permissions: block is touched — ci.yml keeps the scopes set in Harden CI: least-privilege top-level token scopes (5 remaining workflows) #5250/Harden CI: least-privilege token scopes for the last 3 workflows #5253.
• Local composite reference uses: ./.github/actions/setup-openclaw is left alone (repo-relative, already immutable).

Notes

• Batched to one workflow file plus the composite it depends on, per the "one concern, reviewable size" rule. The remaining ~117 unpinned references across 31 other workflow files are follow-up batches.
• Touches only .github/, so the product-record gate does not apply.

No-PRD: CI/supply-chain hardening confined to .github/; no product surface changes.

---

Generated by Claude Code

[8090-software-factory]

✅ Drift Bot (ClawMetry): no drift detected

Drift Bot analyzed the changed files against this project's blueprints and requirements and found no drift.