GA-C001: Unpinned action version

Using a mutable version tag like @v4 allows the action maintainer to push breaking changes or malicious code to that tag without your knowledge. Pin to a full commit SHA to ensure immutable, reproducible builds. The tj-actions/changed-files supply chain attack (March 2025) compromised 23,000+ repos via tag mutation.