ci: address review — SHA-pin release actions + fail-loud dev-version stamp

Two medium findings from the PR review:

- [security] The wheel/sdist now published to PUBLIC PyPI is built in the
  release job, which pulled actions via mutable tags (setup-uv@v4,
  docker/{setup-buildx,login,build-push}@vn). A repointed tag / upstream
  takeover would reach every `pip install coder-eval` user, in a job that
  also holds RELEASE_APP_PRIVATE_KEY and the Azure PAT. Pin all four to
  full commit SHAs (setup-uv now matches publish-testpypi.yml).

- [resilience] The TestPyPI dev-version stamp used re.sub, which returns
  the text unchanged (rc=0) on a version-line format drift, silently
  publishing the base version -> TestPyPI collision masked by
  skip-existing, so the dry run passes green having validated nothing.
  Switch to re.subn and SystemExit when the match count != 1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: uipreliga

.github/workflows/publish-testpypi.yml

@@ -73,7 +73,13 @@ jobs:
           ):
               p = pathlib.Path(path)
               key = "version" if path.endswith("toml") else "__version__"
-              p.write_text(re.sub(pat, f'{key} = "${DEV_VERSION}"', p.read_text(), count=1))
+              # re.subn (not re.sub) so a version-line format drift aborts loudly
+              # instead of silently no-op'ing (rc=0) and publishing a stale/base
+              # version that then collides on TestPyPI (masked by skip-existing).
+              new, n = re.subn(pat, f'{key} = "${DEV_VERSION}"', p.read_text(), count=1)
+              if n != 1:
+                  raise SystemExit(f"version pattern did not match {path} (matched {n}); refusing to publish a stale/colliding artifact")
+              p.write_text(new)
           PY
           echo "Stamped dev version: ${DEV_VERSION}"
 

.github/workflows/release.yml

@@ -79,7 +79,7 @@ jobs:
           python-version: "3.13"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4.2.0
         with:
           enable-cache: true
 
@@ -161,19 +161,19 @@ jobs:
 
       - name: Set up Docker Buildx
         if: steps.release.outputs.version != ''
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0
 
       - name: Log in to GHCR
         if: steps.release.outputs.version != ''
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push versioned agent image
         if: steps.release.outputs.version != ''
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6.19.2
         with:
           context: .
           file: docker/Dockerfile