Pin actions/download-artifact to commit sha

[augbastos]

Pins actions/download-artifact in .github/workflows/scpe-seal.yml to the specific commit d3f86a106a0bac45b974a628896c90dbdf5c8093 per the issue instructions to prevent silent upstream changes.

I also verified that the workflow syntax parses correctly using pyyaml and that existing tests (hook/test_devcard_lib.py and tsc for the worker) still pass.

---

PR created automatically by Jules for task 13641213937012121771 started by @augbastos

Summary by CodeRabbit

• Chores
  • Updated an internal automation action to use a fixed, version-controlled reference for improved build reliability and consistency.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[strix-security]

Strix Security Review

No security issues found.

_{Updated for 59874f5.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 75ebba60-cd45-4515-ad15-49ecf5eb0d95

📥 Commits

Reviewing files that changed from the base of the PR and between 9b37b17 and 59874f5.

📒 Files selected for processing (1)

• .github/workflows/scpe-seal.yml

---

📝 Walkthrough

Walkthrough

The SCPE seal workflow now pins actions/download-artifact to a fixed commit SHA instead of the floating v4 tag.

Changes

Workflow action pinning

Layer / File(s)	Summary
Pin artifact download action .github/workflows/scpe-seal.yml	The workflow references actions/download-artifact by fixed commit SHA.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 59874

This change pins the workflow dependency to a specific commit without introducing an actionable merge-blocking risk; it is merge-ready after normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the change and verification, but it omits the required AI use section and disclosure.	Add the AI use section and tick exactly one option, or add an Assisted-by trailer to a commit.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning actions/download-artifact to a commit SHA.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jules/pin-download-artifact-13641213937012121771

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

ℹ️ No AI-use disclosure found (informational — set require: "true" on this Action to enforce).