security: repair scanning and close stale alert sources

.github/workflows/sensing-server-docker.yml

@@ -48,7 +48,7 @@ jobs:
     name: build · push · smoke-test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           submodules: recursive
 
@@ -56,9 +56,9 @@ jobs:
       # linux/arm64 layer below (Dockerfile.rust is arch-agnostic — no `--target`
       # flag — so buildx + QEMU is all that's needed; arm64 builds are emulated
       # by the runner, not built on a separate arm64 host).
-      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
 
       - name: Log in to Docker Hub
         # Bypassing docker/login-action@v3: the action kept emitting
@@ -73,7 +73,7 @@ jobs:
           printf '%s' "$DH_TOKEN" | docker login docker.io -u "$DH_USER" --password-stdin
 
       - name: Log in to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -81,7 +81,7 @@ jobs:
 
       - name: Compute tags
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302
         with:
           images: |
             docker.io/ruvnet/wifi-densepose
@@ -94,7 +94,7 @@ jobs:
 
       - name: Build + push
         id: build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
         with:
           context: .
           file: docker/Dockerfile.rust