Backport workflow-hardening fix (unpinned-uses) to `2.x`

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/integrate.yaml against the issue(s) below, but the release branch 2.x still carries it. This proposes the same, minimal fix for that branch.

Affected branch / file

• branch: 2.x (HEAD 40f5d5aa)
• file: .github/workflows/integrate.yaml

What's flagged (by zizmor)

• unpinned-uses — actions referenced by mutable tag/branch instead of a pinned commit SHA

These are already resolved on the default branch in 01c79c8 but the fix was not backported to 2.x.

Suggested fix

Concretely:

• ~ jobs.$J.steps[uses=pnpm/action-setup].uses : pin(pnpm/action-setup -> target_ref SHA)

--- a/.github/workflows/integrate.yaml
+++ b/.github/workflows/integrate.yaml
@@ -25,7 +25,7 @@
       - name: Checkout
         uses: actions/checkout@v4
       - name: Setup PNPM
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1  # v4
         with:
           run_install: true
       - name: Build the extension

(Whitespace is normalized in the diff above; only the security-relevant lines change.) This patch was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced.

---

This issue was prepared by an automated workflow-hardening analysis and double-checked against the two scanners above. Please review before merging — happy to send a pull request instead if that's preferred.

[ematipico]

PRs welcome to setup zizmor in the repository

[nhedger]

Setting up zizmor on the main branch seems sensible, however 2.x is basically archived and never used, so not sure this change is actually warranted