Summary

Pins GitHub Actions references in the Docker publish workflow to immutable commit SHAs.

Security Impact

Mutable action tags can move over time. Pinning actions to commit SHAs ensures the workflow executes the exact reviewed action revisions.

Changes

• Pinned checkout, Java, Maven, Node.js, artifact, and Docker action references to full commit SHAs.
• Preserved the existing workflow behavior and configuration.

Validation

• Verified the workflow file parses as YAML.
• Verified all uses: references in the workflow are pinned to 40-character commit SHAs.