ci: pin github actions to commit shas

[dev-jodee]

Summary

• Pin all 34 previously unpinned uses: refs across 12 workflow files to immutable 40-hex commit SHAs.
• Tags and branches are mutable: an action owner (or an attacker with write access) can move v7 or stable to new code, and CI would silently run it. A commit SHA cannot be moved, so what ran yesterday is what runs today.
• Each pin keeps a trailing # <version> comment so the file stays readable at a glance, and so dependabot can recognize and bump the pins.
• Duplicated actions at different majors were pinned to their own SHAs, not unified: actions/cache stays at v4.3.0 in fuzz.yml and v6.1.0 elsewhere.
• dtolnay/rust-toolchain@stable selects the Rust channel by branch name, so it is pinned to the current stable-branch SHA with the comment # stable.

Test Plan

• grep -rn "uses:" .github/ returns zero refs that are not a 40-hex SHA (excluding local ./ composite refs).
• git diff touches only uses: lines; no other edits.
• CI on this PR exercises the pinned refs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
solana-subscriptions-program	Ready	Preview	Sep 1, 2026 2:36pm UTC

[github-actions]

Compute Unit Report

Instruction	Samples	CUs	Est Cost (Low) [SOL]	Est Cost (Med) [SOL]	Est Cost (High) [SOL]	Δ Avg vs main
cancel_subscription	28	1838	0.000005000	0.000005073	0.000005919
cancel_subscription_now	5	1873	0.000005000	0.000005074	0.000005936
close_subscription_authority	22	1804	0.000005000	0.000005072	0.000005902
create_fixed_delegation	50	3529	0.000005001	0.000005141	0.000006764
create_plan	141	3501	0.000005001	0.000005140	0.000006750
create_recurring_delegation	35	3566	0.000005001	0.000005142	0.000006783
delete_plan	10	359	0.000005000	0.000005014	0.000005179
init_subscription_authority	231	6310	0.000005001	0.000005252	0.000008155
resume_subscription	4	2041	0.000005000	0.000005081	0.000006020
revoke_abandoned_delegation	3	403	0.000005000	0.000005016	0.000005201
revoke_abandoned_subscription	2	2052	0.000005000	0.000005082	0.000006026
revoke_delegation	24	282	0.000005000	0.000005011	0.000005141
revoke_subscription_authority	8	3576	0.000005001	0.000005143	0.000006788
subscribe	52	6642	0.000005001	0.000005265	0.000008321
transfer_fixed	10	5638	0.000005001	0.000005225	0.000007819
transfer_recurring	21	5749	0.000005001	0.000005229	0.000007874
transfer_subscription	14	5990	0.000005001	0.000005239	0.000007995
update_plan	31	2142	0.000005000	0.000005085	0.000006071

🔺 increase · 🔻 decrease · – unchanged · 🆕 new · 🗑 removed (vs main)

Generated: 2026-09-01