ci: pin third-party actions to commit SHAs, add concurrency and timeout

BuildKit caches base layers outside the image store, so the inspect
step failed on CI runners with no cached alpine image. The test now
pulls explicitly and skips when the pull cannot succeed.

.github/workflows/release.yml

@@ -6,22 +6,29 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  packages: write
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   release:
     name: Version, tag, and release
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      packages: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Calculate semantic version
         id: semver
-        uses: lukaszraczylo/semver-generator@v1
+        uses: lukaszraczylo/semver-generator@b5eb8ae15a62d76e81dc4661a49209a8502cf1d3 # v1.17.18
         with:
           config_file: semver.yaml
           repository_local: true
@@ -45,7 +52,7 @@ jobs:
 
       - name: Set up Go
         if: steps.tag.outputs.new == 'true'
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
 
@@ -55,15 +62,15 @@ jobs:
 
       - name: Set up QEMU
         if: steps.tag.outputs.new == 'true'
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Docker Buildx
         if: steps.tag.outputs.new == 'true'
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GitHub Container Registry
         if: steps.tag.outputs.new == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -71,7 +78,7 @@ jobs:
 
       - name: Run goreleaser
         if: steps.tag.outputs.new == 'true'
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           distribution: goreleaser
           version: "~> v2"

internal/tests/delivery_containers_test.go

@@ -387,6 +387,15 @@ func TestDelDockerLayerCountWant_GroundTruth(t *testing.T) {
 		t.Fatalf("write app: %v", err)
 	}
 
+	// BuildKit keeps base layers in its own cache, so alpine:3.20 is not
+	// guaranteed to be in the local image store even after a successful
+	// build below. Pull it explicitly, and treat a pull failure (offline
+	// host, registry rate limit) as an environment limitation rather than
+	// a ground-truth failure.
+	if out, err := exec.Command("docker", "pull", "alpine:3.20").CombinedOutput(); err != nil {
+		t.Skipf("docker pull alpine:3.20 unavailable: %v\n%s", err, out)
+	}
+
 	const tag = "llmtestbench-layercount-groundtruth:test"
 	// #nosec G204 -- tag is a fixed literal and dir is a t.TempDir() path,
 	// never external/user-controlled input.