[OskarEichler]

Summary

• Pin checkout and Ruby setup to the exact commits currently resolved by @v6 and @v1.
• Keep readable version comments beside each immutable reference.
• Preserve the existing read-only workflow permission and matrix behavior.

Impact
A moved or compromised mutable action ref can execute changed third-party code in Tilt's test jobs without a Tilt commit. The workflow is test-only, grants contents: read, and declares no secrets or publishing credentials, so urgency is LOW.

Verification

• Confirmed actions/checkout@v6 resolves to d23441a48e516b6c34aea4fa41551a30e30af803.
• Confirmed ruby/setup-ruby@v1 resolves to 95ef2b042f9d7a56d8268cba8559e2842e2ad01b.
• Workflow YAML parses.
• Existing Ruby 4.0.6 suite passes: 557 runs, 1,165 assertions, 0 failures.
• The gem builds and git diff --check passes.

Breaking change
None. Runtime and package contents are unchanged.

[jeremyevans]

First, why do you consider this an issue at all, considering how Tilt uses the actions? Explain what the worst possible outcome of this could be. Realize that this adds a maintenance burden by requiring a commit hash update every time I want to add a new Ruby version to CI. I realize that for many repositories, you want to specify the action commit hash, I'm just not sure the reasons for doing so apply to this repository.

Second, I'm getting annoyed that you are ignoring my comments in rack/rack-test#360 (comment) regarding any PRs to any of my repositories. You have been warned previously in this repository: #32 (comment) . Note that including headings but not marking them as headings is not considered an appropriate way to "Do not use headings.". Consider this your final warning. I'll add an additionally requirement, don't include [LOW]/[MEDIUM]/[HIGH] prefixes in PR titles. If you must, you can include your determination of importance in the PR description.