Why

The release workflow checked out the repository with mongodb-labs/drivers-github-tools/secure-checkout@v2, a mutable major-version tag. That tag can be repointed without this repository changing, so the code that performs the checkout during a release could change silently, and a given release run could not be tied to known action code. That checkout step runs with an app token and produces the tree that is published, so it is the highest-value step in the workflow to pin.

CodeQL reports this as actions/unpinned-tag, a medium severity alert on .github/workflows/release.yml. Semgrep reports the same class of finding.

What

Pin the action to the commit that v2 currently resolves to, e5bd985711c11e488b42488df376ecf1a9d7b7a4, keeping the version in a trailing comment so the intended release line stays readable.

Not a bump to v3: that changes the behaviour of the release checkout step and deserves its own review.