ci: Fix action pinning

[thompson-tomo]

This PR

• sets github action version so renovate can update

Follow-up Tasks

Improve renovate config

[coderabbitai]

📝 Walkthrough

Walkthrough

GitHub Actions workflows update third-party action references to newer or explicit commit SHAs, with version comments added where applicable. Workflow logic and action inputs remain unchanged.

Changes

Workflow action pinning

Layer / File(s)	Summary
Build and lint action pins .github/workflows/rust.yml	Checkout actions are repinned in both jobs, and Rust cache references receive version comments.
Validation workflow action pins .github/workflows/component-owners.yml, .github/workflows/flagd-ofrep-check.yml, .github/workflows/lint-pr.yml	Ownership, OFREP, and PR lint workflows update action revisions and version comments.
Release workflow action pins .github/workflows/release-please.yml	Release, checkout, and Rust cache actions are pinned to specific commits with version comments.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• open-feature/rust-sdk-contrib#118: Updates overlapping GitHub workflow action references.

Suggested reviewers: erenatas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the main change: updating GitHub Actions pins across CI workflows.
Description check	✅ Passed	The description is related to the PR and explains that action versions were updated for Renovate.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/rust.yml:
- Around line 23-25: Add persist-credentials: false to the checkout steps at
.github/workflows/rust.yml lines 23-25 and 65-67,
.github/workflows/flagd-ofrep-check.yml lines 22-24, and
.github/workflows/release-please.yml lines 48-51, preserving their existing
checkout options.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4c6c9e46-c462-434a-baaf-7451ff633263

📥 Commits

Reviewing files that changed from the base of the PR and between 0755435 and 57082db.

📒 Files selected for processing (5)

• .github/workflows/component-owners.yml
• .github/workflows/flagd-ofrep-check.yml
• .github/workflows/lint-pr.yml
• .github/workflows/release-please.yml
• .github/workflows/rust.yml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Disable persisted checkout credentials across all workflows.

Each checkout leaves GITHUB_TOKEN in .git/config by default. Add persist-credentials: false at every site below, especially before commands that execute repository code.

• .github/workflows/rust.yml#L23-L25: add the setting to the build checkout.
• .github/workflows/rust.yml#L65-L67: add the setting to the lint checkout.
• .github/workflows/flagd-ofrep-check.yml#L22-L24: add the setting to the validation checkout.
• .github/workflows/release-please.yml#L48-L51: add the setting to the release checkout.

🧰 Tools

🪛 zizmor (1.28.0)

[warning] 23-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 3 files

• .github/workflows/rust.yml#L23-L25 (this comment)
• .github/workflows/flagd-ofrep-check.yml#L22-L24
• .github/workflows/release-please.yml#L48-L51

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/rust.yml around lines 23 - 25, Add persist-credentials:
false to the checkout steps at .github/workflows/rust.yml lines 23-25 and 65-67,
.github/workflows/flagd-ofrep-check.yml lines 22-24, and
.github/workflows/release-please.yml lines 48-51, preserving their existing
checkout options.

Source: Linters/SAST tools