[CI] Pin used GH Actions (#7716)

* pin used actions

plus some reordering and harmonization across files

* [CI] Link the version string and RNG stub into the test targets

The distribution libgtest.a now used by the Linux images makes the linker
pull more translation units out of libcockatrice_network than the fetched
googletest did. Those units reference VERSION_STRING and the global rng,
which several test targets never defined, so the instrumented Ubuntu 26.04
legs failed at link:

  undefined reference to `VERSION_STRING'
  undefined reference to `rng'

Add the generated version string source wherever a test links the network
umbrella, and define the rng stub in the tests that pull the server game
classes without declaring it. This matches what the neighbouring server
tests already do.

A full Debug build and ctest suite in the ci-ubuntu2604 image (system
libgtest.a) is green: 841 tests pass.

Fixes the nightly failures introduced by #6894.

---------

Co-authored-by: Lukas Brübach <44814898+BruebachL@users.noreply.github.com>

.github/workflows/vcpkg-cache-import.yml

@@ -23,8 +23,10 @@ permissions:
 
 on:
   workflow_run:
-    workflows: ["Build Desktop"]
-    types: [completed]
+    workflows:
+      - 'Build Desktop'
+    types:
+      - completed
 
 # Every import writes the same scopes, so let them queue instead of racing each other
 concurrency:
@@ -33,12 +35,12 @@ concurrency:
 
 jobs:
   list:
-    name: List new vcpkg entries
+    name: "List new vcpkg entries"
     # Only a successful push to the default branch has archives worth importing.
     # Only code that landed on master may populate the scope master runs restore.
     # Bot actors are excluded on top: their runs must never promote binaries into
     # the shared scope even if they somehow target the default branch.
-    if: >-
+    if: |
       github.event.workflow_run.conclusion == 'success' &&
       (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'schedule') &&
       github.event.workflow_run.head_branch == 'master' &&
@@ -46,6 +48,7 @@ jobs:
       !endsWith(github.event.workflow_run.actor.login, '[bot]') &&
       !endsWith(github.event.workflow_run.triggering_actor.login, '[bot]')
     runs-on: ubuntu-slim    # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
+
     # workflow_run is a low-trust trigger, so cache access is read-only by default even
     # though this run resolves to the default branch. Assert below that this took effect,
     # because a save under read-only access only warns and would import nothing silently.
@@ -55,7 +58,7 @@ jobs:
 
     steps:
       - name: "Download new vcpkg entries"
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: vcpkg-new-*
           path: incoming
@@ -66,7 +69,7 @@ jobs:
         shell: bash
         run: |
           if [[ $ACTIONS_CACHE_MODE != *write* ]]; then
-            echo "::error::expected a write-capable cache, got '$ACTIONS_CACHE_MODE'"
+            echo "::error::Expected a write-capable cache, got '$ACTIONS_CACHE_MODE'"
             exit 1
           fi
 
@@ -88,14 +91,16 @@ jobs:
           # Compact, because a multi line value cannot be written to GITHUB_OUTPUT
           entries="$(jq -cs '.' <<<"$entries")"
           echo "entries=$entries" >>"$GITHUB_OUTPUT"
-          echo "::notice::importing $(jq length <<<"$entries") vcpkg entries"
+          echo "::notice::Importing $(jq length <<<"$entries") vcpkg entries"
 
   save:
     name: "Save ${{ matrix.entry.key }}"
-    needs: list
     if: needs.list.outputs.entries
-    runs-on: ubuntu-slim
+    needs: list
+    runs-on: ubuntu-slim    # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
+
     cache-mode: write
+
     strategy:
       # One job per archive, they run in parallel and each only uploads a single file
       fail-fast: false
@@ -105,7 +110,7 @@ jobs:
 
     steps:
       - name: "Download new vcpkg entries"
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: ${{ matrix.entry.artifact }}
           path: incoming
@@ -113,7 +118,7 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: "Save vcpkg entry"
-        uses: actions/cache/save@v6
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           # The payload is a Windows or macOS archive while the upload runs on Linux, and
           # without this the entry would be stamped as a Linux cache that neither of them