pin third-party GitHub actions to commit SHAs

[felixarntz]

action.yml had nick-fields/retry@v4 - this is not great for two reasons:

• it's a security best practice to pin 3P actions to commit SHAs to decrease the risk for supply chain attacks
• for that reason GitHub even has a setting to enforce it, but repos that use it can currently not use wordpress/plugin-check-action because of this one instance lacking the commit SHA pin

since it's a security best practice, this PR also cleans up the action's own workflows to only have pinned commit SHAs. Ideally, once this is merged, the repo will enable the GitHub setting to enforce it, to prevent degradation in the future.

[github-actions]

🔍 WordPress Plugin Check Report

❌ Status: Failed

📊 Report

🎯 Total Issues	❌ Errors	⚠️ Warnings
9	8	1

---

❌ Errors (8)

📁 hello.php (7 errors)

📍 Line	🔖 Check	💬 Message
0	plugin_header_no_license	Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license.
0	missing_direct_file_access_protection	PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
49	WordPress.WP.AlternativeFunctions.rand_mt_rand	mt_rand() is discouraged. Use the far less predictable wp_rand() instead.
62	WordPress.Security.EscapeOutput.OutputNotEscaped	All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '__'.
62	WordPress.WP.I18n.TextDomainMismatch	Mismatched text domain. Expected 'hello-dolly-copy' but got 'hello-dolly'.
63	WordPress.Security.EscapeOutput.OutputNotEscaped	All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$lang'.
64	WordPress.Security.EscapeOutput.OutputNotEscaped	All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$chosen'.

📁 readme.txt (1 error)

📍 Line	🔖 Check	💬 Message
0	no_plugin_readme	The plugin readme.txt does not exist.

---

⚠️ Warnings (1)

📁 hello.php (1 warning)

📍 Line	🔖 Check	💬 Message
72	WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound	Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "dolly_css".

---

🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check

[felixarntz]

for some reason, the previous version number here was wrong for this SHA 🤷