Pin workflow actions and service images to immutable SHAs (#58964)

Pins the remaining tag- and branch-referenced GitHub Actions and the
`postgres` service image to specific commit SHAs / digests, so workflow
runs resolve to fixed versions. Edited in the xtask workflow DSL and
regenerated with `cargo xtask workflows`.

- `bufbuild/buf-setup-action` → `a47c93e0` (v1.50.0)
- `bufbuild/buf-breaking-action` → `c57b3d84` (v1.1.4)
- `digitalocean/action-doctl` → `3cb39531` (v2.5.2)
- `postgres:15` → `@sha256:1b92e7a8…`
- `deploy_docs.yml` reusable workflow → pinned to a commit

Release Notes:

- N/A

.github/workflows/after_release.yml

@@ -41,7 +41,7 @@ jobs:
     if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions')
     permissions:
       contents: read
-    uses: zed-industries/zed/.github/workflows/deploy_docs.yml@main
+    uses: zed-industries/zed/.github/workflows/deploy_docs.yml@3f16f7b9082f8828e4d6ae207d2349b1ef932517
     secrets:
       DOCS_AMPLITUDE_API_KEY: ${{ secrets.DOCS_AMPLITUDE_API_KEY }}
       DOCS_CONSENT_IO_INSTANCE: ${{ secrets.DOCS_CONSENT_IO_INSTANCE }}

.github/workflows/deploy_collab.yml

@@ -73,7 +73,7 @@ jobs:
       run: cargo nextest run --package collab --no-fail-fast
     services:
       postgres:
-        image: postgres:15
+        image: postgres:15@sha256:1b92e7a80c021647bf70f5d3eb66066a998e4f5cf43c07bb9dc9f729782cf88e
         env:
           POSTGRES_HOST_AUTH_METHOD: trust
         ports:
@@ -87,7 +87,7 @@ jobs:
     runs-on: namespace-profile-16x32-ubuntu-2204
     steps:
     - name: deploy_collab::publish::install_doctl
-      uses: digitalocean/action-doctl@v2
+      uses: digitalocean/action-doctl@3cb3953159719656269e044e0e24ca16dd2a690f
       with:
         token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
     - name: deploy_collab::publish::sign_into_registry
@@ -117,7 +117,7 @@ jobs:
       with:
         clean: false
     - name: deploy_collab::deploy::install_doctl
-      uses: digitalocean/action-doctl@v2
+      uses: digitalocean/action-doctl@3cb3953159719656269e044e0e24ca16dd2a690f
       with:
         token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
     - name: deploy_collab::deploy::sign_into_kubernetes

.github/workflows/deploy_nightly_docs.yml

@@ -10,7 +10,7 @@ jobs:
     if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions')
     permissions:
       contents: read
-    uses: zed-industries/zed/.github/workflows/deploy_docs.yml@main
+    uses: zed-industries/zed/.github/workflows/deploy_docs.yml@3f16f7b9082f8828e4d6ae207d2349b1ef932517
     secrets:
       DOCS_AMPLITUDE_API_KEY: ${{ secrets.DOCS_AMPLITUDE_API_KEY }}
       DOCS_CONSENT_IO_INSTANCE: ${{ secrets.DOCS_CONSENT_IO_INSTANCE }}

.github/workflows/release.yml

@@ -100,7 +100,7 @@ jobs:
     timeout-minutes: 60
     services:
       postgres:
-        image: postgres:15
+        image: postgres:15@sha256:1b92e7a80c021647bf70f5d3eb66066a998e4f5cf43c07bb9dc9f729782cf88e
         env:
           POSTGRES_HOST_AUTH_METHOD: trust
         ports:

.github/workflows/release_nightly.yml

@@ -83,7 +83,7 @@ jobs:
     timeout-minutes: 60
     services:
       postgres:
-        image: postgres:15
+        image: postgres:15@sha256:1b92e7a80c021647bf70f5d3eb66066a998e4f5cf43c07bb9dc9f729782cf88e
         env:
           POSTGRES_HOST_AUTH_METHOD: trust
         ports:

.github/workflows/run_tests.yml

@@ -399,7 +399,7 @@ jobs:
     timeout-minutes: 60
     services:
       postgres:
-        image: postgres:15
+        image: postgres:15@sha256:1b92e7a80c021647bf70f5d3eb66066a998e4f5cf43c07bb9dc9f729782cf88e
         env:
           POSTGRES_HOST_AUTH_METHOD: trust
         ports:
@@ -794,12 +794,12 @@ jobs:
           echo "BUF_BASE_BRANCH=$GITHUB_BASE_REF" >> "$GITHUB_ENV"
         fi
     - name: run_tests::check_postgres_and_protobuf_migrations::bufbuild_setup_action
-      uses: bufbuild/buf-setup-action@v1
+      uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99
       with:
         version: v1.29.0
         github_token: ${{ secrets.GITHUB_TOKEN }}
     - name: run_tests::check_postgres_and_protobuf_migrations::bufbuild_breaking_action
-      uses: bufbuild/buf-breaking-action@v1
+      uses: bufbuild/buf-breaking-action@c57b3d842a5c3f3b454756ef65305a50a587c5ba
       with:
         input: crates/proto/proto/
         against: https://github.com/${GITHUB_REPOSITORY}.git#branch=${BUF_BASE_BRANCH},subdir=crates/proto/proto/