chore: migrate to pinned actions and upgrade

[remyleone]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Relates OR Closes #0000

Release note for CHANGELOG:

[Copilot]

Pull request overview

This PR updates the repository’s GitHub Actions workflows to use pinned (commit-SHA) action references, improving CI reproducibility and reducing supply-chain risk.

Changes:

• Pin actions/checkout and actions/setup-python to specific commit SHAs across workflows.
• Pin additional third-party actions used in CI (e.g., Codecov, cache, labeler, gh-pages) to commit SHAs.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/typing.yml	Pins checkout/setup-python in typing workflows.
.github/workflows/release.yml	Pins checkout/setup-python in release workflows.
.github/workflows/pytest-cov.yml	Pins checkout/setup-python and Codecov actions.
.github/workflows/nightly.yml	Pins checkout/setup-python in nightly workflow.
.github/workflows/lint.yml	Pins checkout/setup-python in lint workflow.
.github/workflows/labeler.yml	Pins checkout and labeler action.
.github/workflows/format.yml	Pins checkout/setup-python in formatting workflow.
.github/workflows/docs.yml	Pins checkout/setup-python/cache/gh-pages actions.
.github/workflows/checks.yml	Pins checkout/setup-python in test workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.