[xiang-baseten]

🚀 What

Pin CI and release actions to Chainguard commits.

💻 How

Use matching versions where available. Move setup-uv to v10.3.3 and the GoReleaser action to v7.3.0, with uv cache pruning enabled.

🔬 Testing

Passed YAML parsing, action manifest checks, actionlint, workflow structure checks, and git diff --check.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

🟢 Approval recommended

No active review issues were identified for the CI and release workflow action-pinning changes.

No open issues 🎉

What changed in this PR

Pins CI and release workflow actions to Chainguard commit hashes, making action dependencies immutable.

Changes:

• Replaces upstream action references with pinned Chainguard equivalents, retaining matching versions where available.
• Upgrades the setup-uv action to v10.3.3 and enables cache pruning.
• Upgrades the GoReleaser action to v7.3.0.

File	Description
.github/​workflows/​release.yml	Pins checkout, Go setup, app-token creation, and GoReleaser actions.
.github/​workflows/​ci.yml	Pins checkout, Go, Node, and uv setup actions; enables uv cache pruning.

_{Review effort: Balanced}