ci: pin tag workflows to github.sha

Ensure tag-triggered releases checkout the exact commit
and avoid git 128 during re-tags.

Author: Hendler

.github/workflows/release-pypi.yml

@@ -18,6 +18,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.sha }}
 
       - name: Extract version from tag
         id: extract
@@ -80,6 +81,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.sha }}
 
       - uses: actions/setup-python@v5
         with:
@@ -131,6 +133,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.sha }}
 
       - uses: actions/setup-python@v5
         with:

.github/workflows/release.yml

@@ -19,6 +19,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.sha }}
 
       - name: Extract version from tag
         id: extract
@@ -102,6 +103,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.sha }}
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -155,6 +157,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.sha }}
 
       - uses: actions/setup-node@v4
         with: