Pin remaining GitHub Actions

[tijmendj]

Part of https://github.com/channable/devops/issues/13319.

Some people argued that it would be more consistent if we also pinned GitHub owned (i.e. github.com/actions/checkout) Actions.

[Copilot]

Pull request overview

This PR updates the GitHub Actions workflow to pin actions/checkout to a specific commit SHA instead of using the v4 tag reference, improving security and consistency by making all external Actions use commit SHAs.

Changes:

• Replaced three instances of actions/checkout@v4 with the pinned commit SHA 0c366fd6a839edf440554fa01a7085ccba70ac98

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Qqwy]

Thank you Tijmen! I understand the sentiment, and while I think it is not the most important thing in the world, it definitely cannot hurt to pin GitHub's own actions as well.

@OpsBotPrime merge

[OpsBotPrime]

Your merge request has been denied, because merging on Fridays is not recommended. To override this behaviour use the command merge on Friday.

[Qqwy]

@OpsBotPrime merge on Friday

[OpsBotPrime]

Rebased as 4809da9, waiting for CI …

[OpsBotPrime]

CI job 🟡 started.

[OpsBotPrime]

The build failed ❌.

If this is the result of a flaky test, then tag me again with the retry command. Otherwise, push a new commit and tag me again.

[Qqwy]

@OpsBotPrime retry on Friday

[OpsBotPrime]

Rebased as 4809da9, waiting for CI …

[OpsBotPrime]

CI job 🟡 started.