CI SHA-pinning

[PhysShell]

CI SHA-pinning: agreed it's a reasonable call for this PoC (recorded a "learning" to defer it to Dependabot/a hardening pass).

[mrpunyetaz-cloud]

Duplicate of #5

[PhysShell]

@mrpunyetaz-cloud hi! please provide more details as i'm unable to see in what place it is duplicate

[PhysShell]

Agent brief (for handing this issue to a coding agent — tier: basic. One PR, Closes #7; branch from main.)

Pin every third-party uses: owner/action@tag across the five workflows (.github/workflows/ci.yml, mine.yml, mine-on-push.yml, oracle.yml, pr-issue-validation.yml) to the full commit SHA with a trailing # vN version comment. Leave local ./ action references untouched.

Done when: no mutable tag remains in any uses: line, the version comments make future bumps reviewable, and CI is green.

---

Generated by Claude Code