- Pin all actions to commit SHAs for supply chain security
- Replace actions/upload-artifact@v4 with ChristopherHX/gitea-upload-artifact
- Replace actions/download-artifact@v4 with ChristopherHX/gitea-download-artifact
- These forks work on Gitea Actions (GHES-compatible)