Pin floating action refs to SHAs

[db-ks]

Summary

• opentap/setup-opentap and actions/checkout in action.yml were using floating tag references
• actions/checkout in .github/workflows/test.yml was using a floating tag reference
• Pinned all to their current commit SHAs with version comments for readability

Details

File	Action	Before	After
action.yml	opentap/setup-opentap	@main	@6eee68cf35f2e861f93d21029bbe7af4c427b9bd (v1.1, main branch)
action.yml	OpenTAP version	9.25.0 (.NET 6)	9.28.3 (.NET 9)
action.yml	actions/checkout	@v4	@de0fac2e4500dabe0009e67214ff5f5447ce83dd (v6.0.2)
test.yml	actions/checkout	@v2	@de0fac2e4500dabe0009e67214ff5f5447ce83dd (v6.0.2)
test.yml	runs-on	ubuntu-latest	ubuntu-24.04

Motivation

The upgrade of actions/checkout from v4 to v6 in the internal action.yml also fixes a compatibility issue: actions/checkout@v6 introduced a new credential persistence mechanism that conflicts with the previously used @v4 inside this action, causing a duplicate Authorization header → HTTP 400 error in downstream repos that use actions/checkout@v6 in their outer workflow.

ubuntu-latest → ubuntu-24.04 in test.yml:
GitHub-hosted runners have no SHA equivalent. Pinning to a versioned label like ubuntu-24.04 is the closest equivalent — it won't silently move to a new OS version the way ubuntu-latest does when GitHub rolls out a migration (over 1–2 months). ubuntu-latest currently resolves to ubuntu-24.04, so there is no functional difference today.

opentap/setup-opentap SHA points to main branch (to be tagged as v1.1):
main branch includes the merged PR#19 which upgrades the action's Node.js runtime from node20 to node24, fixes deprecated ubuntu-20.04 runners, and pins actions/checkout to a SHA. The SHA will be updated to the v1.1 tag once it is cut.

[rmadsen-ks]

Looks great!