Pin GitHub Actions to commit SHAs and harden Renovate config

[titouanmathis]

Problem

The Semgrep Security Scan job was failing with 27 findings — all in CI configuration, none in application code:

• 24× github-actions-mutable-action-tag in ci.yml, publish.yml, security.yml — workflow steps referenced mutable tags (@v4, @v5, @v1). A mutable tag can be silently repointed by the action owner, which was the vector in the tj-actions/changed-files compromise.
• 3× renovate-missing-minimum-release-age in renovate.json — no cooldown before proposing/auto-merging newly published versions.

These pre-existed on main (not introduced by any recent PR).

Fix

• Pin all 24 uses: to full 40-char commit SHAs with # vX version comments. Pinned the current major of each action (no version bumps — those are left to Renovate so they get tested independently):
  • actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4, actions/download-artifact@v4, codecov/codecov-action@v5, ncipollo/release-action@v1
• Add helpers:pinGitHubActionDigests to Renovate's extends so it keeps the pinned digests updated automatically (pinning and Renovate are complementary, not in conflict).
• Set minimumReleaseAge: "7 days" globally and within each package rule. The Semgrep rule (p/owasp-top-ten) requires ≥ 7 days, so all cooldowns — including security updates — are set to 7 days.

Verification

Ran the exact CI Semgrep command locally via Docker: 0 findings (down from 27), exit 0. No application code changed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.45%. Comparing base (7f77c8e) to head (59776db).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #120   +/-   ##
=======================================
  Coverage   99.45%   99.45%           
=======================================
  Files         235      235           
  Lines        4033     4033           
  Branches     1027     1031    +4     
=======================================
  Hits         4011     4011           
  Misses         22       22           

Flag	Coverage Δ
unittests	99.45% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.