Pin GitHub Actions to full-length commit SHAs

[iasolanki]

What this PR does / why we need it:

kubernetes/klog now enforces the org policy that every GitHub Action must be pinned to a full-length commit SHA rather than a version tag. As a result, all workflow runs on main currently fail at the Set up job step, before any code is checked out or run:

The actions actions/setup-go@v5 and actions/checkout@v4 are not allowed in kubernetes/klog because all actions must be pinned to a full-length commit SHA.

This pins each action to the commit SHA of the latest release within the major version already in use, keeping the human-readable version in a trailing comment:

Action	Version	SHA
actions/checkout	v4.3.1	34e114876b0b11c390a56381ad16ebd13914f8d5
actions/setup-go	v5.6.0	40f1582b2485089dde7abd97c1529aa768e1baff
golangci/golangci-lint-action	v6.5.2	55c2c1448f86e01eaae002a5a3a9624417608d84

Requested by @dims in #438.

Which issue(s) this PR fixes:

Special notes for your reviewer:

No functional change to the workflows — only the action references are pinned. Each SHA was verified to resolve to the tag noted in its comment.

Release note:

NONE

[kubernetes-prow]

This issue is currently awaiting triage.

If klog contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[iasolanki]

/assign @dims

[dims]

/approve
/lgtm

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, iasolanki

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dims]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[iasolanki]

@dims Is it possible for you to rerun the failed tests. If I do an empty commit, the lgtm label would be removed. Since this PR only pinned action SHAs and no GO code, it couldnt have caused this, so looks like a flaky test. Thanks!