ci: update action versions and apply harderning

[fzipi]

what

• update and pin gha
• apply zizmor locally

why

• harden and update gha

Summary by CodeRabbit

• Chores
  • Updated multiple automated workflow actions to newer pinned versions across linting, publishing, and image verification.
  • Improved workflow consistency by tightening checkout settings and credential handling.
  • No changes to product behavior, build outputs, or user-facing features.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4149b058-2432-4b7b-9f4a-20ab89e6b314

📥 Commits

Reviewing files that changed from the base of the PR and between b63f25d and 48972ee.

📒 Files selected for processing (3)

• .github/workflows/lint.yml
• .github/workflows/publish.yml
• .github/workflows/verifyimage.yml

---

📝 Walkthrough

Walkthrough

This PR updates pinned GitHub Actions versions/SHAs across three CI workflow files (lint.yml, publish.yml, verifyimage.yml), including checkout, buildx, qemu, docker login, bake-action, artifact upload/download, and cosign-installer steps. Several checkout steps additionally add persist-credentials: false.

Changes

GitHub Actions version updates

Layer / File(s)	Summary
Lint workflow checkout .github/workflows/lint.yml	Checkout step pinned to a newer commit SHA with persist-credentials: false added.
Publish workflow updates .github/workflows/publish.yml	Pinned revisions updated for checkout, buildx, upload/download-artifact, qemu, docker login, bake-action, and cosign-installer across the prepare, build, and merge jobs.
Verifyimage workflow updates .github/workflows/verifyimage.yml	Pinned revisions updated for checkout, bake-action matrix, qemu, buildx, login-action, bake-action, and upload-artifact steps; persist-credentials: false added to checkout steps including the CRS checkout.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: enhancement

Suggested reviewers: theseion

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: updating pinned GitHub Actions versions and hardening CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/update-gha

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR hardens and updates GitHub Actions workflows by bumping action dependencies to newer pinned SHAs (verified to match the referenced tags) and tightening checkout behavior to avoid persisting credentials.

Changes:

• Update/pin actions/*, docker/*, and sigstore/* workflow actions to newer tagged versions (pinned by commit SHA).
• Apply workflow hardening by setting persist-credentials: false on relevant actions/checkout steps.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/verifyimage.yml	Bumps/pins actions used for image verification and adds persist-credentials: false to checkouts.
.github/workflows/publish.yml	Updates/pins build/publish-related actions (Buildx/Bake/Cosign/artifacts) and ensures checkout does not persist credentials.
.github/workflows/lint.yml	Updates/pins checkout action and hardens it with persist-credentials: false.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.