[LOW] security(ci): pin actions to immutable revisions

[OskarEichler]

Security impact

The pull-request and package-release workflows execute actions/checkout@v4, actions/setup-node@v4, and changesets/action@v1 through mutable major-version references. If one of those references is moved or its publishing account is compromised, unreviewed code can execute in CI. The release job has repository write access and npm trusted-publishing access, so immutable action identity matters at that boundary.

Fix

Pin every external action invocation to the exact commit currently selected by its existing major reference, retaining a version comment for update tooling and reviewers:

• actions/checkout v4.4.0
• actions/setup-node v4.4.0
• changesets/action v1.9.0

This does not upgrade action majors or change workflow behavior. Token permissions and the floating npm install are separate focused changes.

Verification

• Both workflow files parse successfully as YAML
• Every uses reference is an immutable 40-character commit SHA
• Each SHA was cross-checked against the named upstream release/tag
• git diff --check passes

No runtime package changes or changeset are needed for CI-only hardening.

[vercel]

@OskarEichler is attempting to deploy a commit to the Nearform Team on Vercel.

A member of the Team first needs to authorize it.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 578d1a2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ilteoood]

At this point it would be worth to upgrade them to their latest version

[OskarEichler]

Upgraded the pins in 578d1a2 to the latest stable releases: checkout v7.0.1, setup-node v7.0.0, and changesets/action v2.1.2. Resolved each release tag to its commit and checked the action manifests; all use the Node 24 action runtime on the hosted ubuntu-latest runner. The application Node version and existing workflow commands remain unchanged. YAML and diff checks pass; I did not execute the privileged publishing workflow.