chore(ci): pin artifact download action

.github/workflows/release.ymlmodified+1-1

Changes to .github/workflows/release.yml

		⋯485 linesShow the 485 lines above this hunk@@ -486,7 +486,7 @@ jobs:
486	486	steps:
487	487	- uses: actions/checkout@v6
488	488	- uses: oven-sh/setup-bun@v2
489		- - uses: actions/download-artifact@v4
	489	+ - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
490	490	with:
491	491	name: sbom
492	492	path: sbom

.github/workflows/sbom.ymlmodified+1-1

Changes to .github/workflows/sbom.yml

		⋯108 linesShow the 108 lines above this hunk@@ -109,7 +109,7 @@ jobs:
109	109	- uses: oven-sh/setup-bun@v2
110	110
111	111	- name: Download SBOM
112		- uses: actions/download-artifact@v4
	112	+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
113	113	with:
114	114	name: sbom
115	115	path: sbom/

scripts/release-workflow.test.tsmodified+3-0

Changes to scripts/release-workflow.test.ts

		⋯11 linesShow the 11 lines above this hunk@@ -12,6 +12,7 @@ type Job = {
12	12	strategy?: { matrix: { platform: { name: string, os: string }[] } }
13	13	}
14	14	const release = Bun.YAML.parse(readFileSync(join(import.meta.dir, '../.github/workflows/release.yml'), 'utf8')) as { jobs: Record<string, Job> }
	15	+const artifactDownload = 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
15	16	const needs = (job: Job) => typeof job.needs === 'string' ? [job.needs] : job.needs ?? []
16	17	const steps = (job: Job) => job.steps?.map(step => step.run ?? '').join('\n') ?? ''
17	18
		⋯64 linesShow the 64 lines above this hunk@@ -82,4 +83,6 @@ test('SBOM generation validates required documents before uploading artifacts',
82	83	expect(command).not.toContain('||')
83	84	const scan = workflow.jobs['vulnerability-scan'].steps!.find(step => step.name === 'Scan and validate vulnerability report')
84	85	expect(scan?.env?.CRAFT_FAIL_HIGH).toBe('$')
	86	+ expect(workflow.jobs['vulnerability-scan'].steps!.find(step => step.uses?.startsWith('actions/download-artifact@'))?.uses).toBe(artifactDownload)
	87	+ expect(release.jobs['attach-release-sbom'].steps!.find(step => step.uses?.startsWith('actions/download-artifact@'))?.uses).toBe(artifactDownload)
85	88	})