fix(MRK-1744): pin GitHub Actions to commit SHAs

[scopsy]

Summary

The novuhq/website repository previously had no GitHub Actions workflows. This change adds a PR lint workflow with all third-party actions pinned to immutable commit SHAs, matching the supply-chain hardening approach used in novuhq/docs and novuhq/novu.

Changes

• Add .github/workflows/pr-checks.yml with:
  • actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 (# v4)
  • actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 (# v4)
• Run npm install and npm run lint on pull requests

Why

Pinning actions to full commit SHAs prevents supply-chain attacks from mutable version tags (e.g. @v4 can be retargeted).

Testing

• Verified npm run lint passes locally (warnings only, no errors)

Slack Thread

  

[linear-code]

MRK-1744

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 01776462-a159-4f3b-8f70-d7bd22369d5e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}