ci: pin external actions to immutable commits

[benjavicente]

Changes

Pins the CI workflows. This seems to be the only repo that uses main directly from tanstack config, so if actions run in the future they would potentially break.

Checklist

• I have followed the steps in the Contributing guide.
• I have tested this code locally with pnpm run test:pr.

Release Impact

• This change affects published code, and I have generated a changeset.
• This change is docs/CI/dev-only (no release).

Summary by CodeRabbit

• Chores
  • Updated the automated pull request, release, and autofix workflows to use fixed versions of their actions, improving consistency in how they run.
  • Workflow steps and behavior remain unchanged.

[changeset-bot]

⚠️ No Changeset found

Latest commit: c262aa0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6cd05e29-fe87-407e-ac36-ff1a30826513

📥 Commits

Reviewing files that changed from the base of the PR and between 3654ae5 and c262aa0.

📒 Files selected for processing: 3

• .github/workflows/autofix.yml
• .github/workflows/pr.yml
• .github/workflows/release.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The autofix, PR, and release workflows now reference GitHub Actions by commit SHA instead of version tags or branch names. Workflow steps, inputs, and execution conditions remain unchanged.

Changes: Workflow action pins

Layer / File(s)	Summary
Autofix and PR workflow pins .github/workflows/autofix.yml, .github/workflows/pr.yml	The workflows pin checkout, setup, SHA-selection, provenance, and changeset-preview actions to commit SHAs.
Release workflow pins .github/workflows/release.yml	The workflow pins checkout, shared setup, Changesets, and release-comment actions to commit SHAs. Comments retain the prior version or branch labels.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: kevinvandy

Merge Risk: ⚪ Minimal · up to c262a

The workflows pin external actions to commits matching their intended targets. No actionable merge-blocking risk was found.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: pinning external CI actions to immutable commits.
Description check		The description includes the required Changes, Checklist, and Release Impact sections. It explains the motivation and identifies the change as CI-related. The checklist items remain unchecked, so test…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description includes the required Changes, Checklist, and Release Impact sections. It explains the motivation and identifies the change as CI-related. The checklist items remain unchecked, so testing and release-impact status are not confirmed, but the description is otherwise complete.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

• @tanstack/persist-example-react-use-storage-state

  npm i https://pkg.pr.new/TanStack/persist/@tanstack/persist@6
  

  npm i https://pkg.pr.new/TanStack/persist/@tanstack/react-persist@6
  

commit: c262aa0