ci: update and pin GitHub actions

[valentinkaas]

This PR updates all GitHub actions to their newest versions. Furthermore, I ran zizmor on the workflows to pin the actions to specific hashes. That also auto-fixes things like using GitHub's native $/.github features for workflows or setting persist-credentials: false for the checkout action. I can just revert those changes though, if needed.

Automatic updates of pinned actions versions will follow in a future pull request.

Summary by CodeRabbit

• Chores
  • Pinned GitHub Actions dependencies to specific versions for more consistent and predictable workflow runs.
  • Disabled credential persistence during repository checkout to improve workflow security.
  • Updated dependency caching to use the UV setup workflow and configured relevant project files as cache inputs.
  • Updated regression workflow configuration and branch pattern handling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 8c062a82-ed9e-43dc-b461-2ad3fccd62e1

📥 Commits

Reviewing files that changed from the base of the PR and between b37f475 and 0ecc5d4.

📒 Files selected for processing (4)

• .github/workflows/_regression-job.yml
• .github/workflows/lint.yml
• .github/workflows/regression-whisk.yml
• .github/workflows/regression.yml

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

CI workflows now pin third-party actions to commit SHAs. Checkout steps disable credential persistence. The lint workflow uses setup-uv for dependency caching. The regression workflow reference path also changes.

Changes

CI workflow changes

Layer / File(s)	Summary
Reusable regression job actions .github/workflows/_regression-job.yml	The reusable job pins checkout, authentication, uv setup, and artifact upload actions.
Lint setup and caching .github/workflows/lint.yml	The lint workflow pins its actions, disables checkout credential persistence, and replaces the standalone uv cache step with setup-uv caching.
Whisk regression action updates .github/workflows/regression-whisk.yml	The workflow pins checkout, Helm, uv, and artifact upload actions. It also changes the branch-pattern quoting.
Regression job reference .github/workflows/regression.yml	The reusable regression workflow reference changes from ./.github/workflows/_regression-job.yml to $/.github/workflows/_regression-job.yml.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 0ecc5

The workflow wiring remains supported and the action updates are pinned; no concrete CI failure risk remains established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: updating and pinning GitHub Actions in CI workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}