🔒 Pin GitHub Actions to commit SHAs

[paulinebm]

🔒 Pin GitHub Actions to commit SHAs

This PR pins all GitHub Actions to their exact commit SHA instead of mutable tags or branch names.

Why?
Pinning to a SHA prevents supply chain attacks where a tag (e.g. v4) could be moved to point to malicious code.

Changes

Workflow	Action	Avant	Après	SHA
ci.yml	actions/checkout	v5	v6.0.2	de0fac2e4500…
ci.yml	actions/setup-node	v4	v4	49933ea5288c…
publish.yml	actions/checkout	v5	v6.0.2	de0fac2e4500…
publish.yml	actions/setup-node	v4	v4	49933ea5288c…
publish.yml	docker/setup-buildx-action	v3	v3	8d2750c68a42…
publish.yml	docker/login-action	v3	v3	c94ce9fb4685…
publish.yml	docker/build-push-action	v6	v6	10e90e3645ea…
publish.yml	docker/build-push-action	v6	v6	10e90e3645ea…
publish.yml	actions/create-release	v1	v1	0cb9c9b65d5d…
publish.yml	actions/setup-node	v4	v4	49933ea5288c…

🤖 Generated by /github-actions-audit — [security/pin-actions-to-sha]

Closes huggingface/tracking-issues#54

---

Note

Low Risk
Low risk: workflow-only changes that just pin existing actions to specific SHAs (and bumps actions/checkout), without altering build/test/publish commands or application code.

Overview
Pins GitHub Actions in ci.yml and publish.yml to immutable commit SHAs (including updating actions/checkout from v5 to v6.0.2) for stronger supply-chain security.

Also pins the Docker actions used during publishing (setup-buildx, login, and build-push), and updates commented action references to SHAs for consistency.

^{Written by Cursor Bugbot for commit d5f006a. This will update automatically on new commits. Configure here.}