[yumike]

Summary

Pin the CI/release toolchain without changing npm dependency declarations or resolutions:

• Pin GitHub Actions to commit SHAs with exact release-version comments: checkout v7.0.1, setup-node v7.1.0, and action-gh-release v3.0.4.
• Pin Node to the existing CI patch, 24.22.2, via a shared .node-version file.
• Select ubuntu-24.04, matching the existing runner OS, instead of the floating ubuntu-latest alias. GitHub still updates packages within that hosted image.
• Configure Renovate to retain GitHub Actions SHA pins.

All package.json files, yarn.lock, and .yarnrc.yml are unchanged from the original base. Dependency versions remain pinned by the existing lockfile and CI's immutable install; no npm exact-version policy is added.

Validation

• Verified every exact action release resolves to its pinned commit SHA.
• Workflow YAML and exact release/SHA checks pass.
• Renovate JSON Schema validation passes.
• Immutable install on Node 24.22.2 passes after restoring manifest ranges and the original lockfile.
• Verified no diff in any package manifest, lockfile, or Yarn configuration against the original base.
• The original pinning iteration passed all 666 tests, typecheck, lint, formatting, plugin builds and separate frontend/backend builds on Node 24.22.2; its installed package resolutions were identical to the restored lockfile.