[JARosen]

Summary

Pin every GitHub Action in the test and PyPI release workflows to the commit currently referenced by its existing release tag. This prevents mutable action tags from changing future CI or publishing runs.

HOL's registry scan scored Foreman 79/100 and required at least 80. The same scanner version (plugin-scanner 3.0.123), profile, and gate now pass at 88/100, with zero critical/high findings and all 11 action-pin findings cleared. The remaining medium/low findings concern a Python lockfile and Dependabot configuration.

Verification

• Parsed both workflows and verified their structure is unchanged after mapping SHA pins back to the original references.
• Clean-source scan: plugin-scanner scan ... --min-score 80 --fail-on-severity high passed.
• git diff --check passed.
• Tests pass (python -m pytest) — Python 3.11, 3.12, and 3.13 PR CI passed; Pi integration CI also passed
• Lint passes (python -m ruff check .) — all Python matrix jobs passed
• Documentation is updated, or no documentation change is needed

Related issue

Unblocks the required source scan for hashgraph-online/awesome-ai-plugins#647.