SHA-pin all GitHub Actions; bump action-gh-release v2 -> v3.0.0

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Run PSScriptAnalyzer
         shell: pwsh

.github/workflows/release.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Run PSScriptAnalyzer
         shell: pwsh
@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Get version from tag
         id: version
@@ -262,7 +262,12 @@ jobs:
           # Note: rwts-codesign.cer (public cert) is kept - needed for release upload and is non-sensitive
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        # SHA-pinned to v3.0.0. This job has the code-signing PFX in scope
+        # via the protected `release` environment; pinning the third-party
+        # action to a specific commit removes the supply-chain risk of a
+        # mutable major tag being repointed at malicious code. Bump
+        # deliberately when a new version is published and reviewed.
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         with:
           name: v${{ steps.version.outputs.VERSION }}
           body_path: release_notes.md

.github/workflows/test-signing.yml

@@ -10,7 +10,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Test certificate and signing
         shell: pwsh