chore: ci/cd workflow improvements and fixes

[esteban]

Summary

• Pin GitHub Actions to full commit SHAs
• Update workflow input handling and parameter validation
• Fix miscellaneous CI/CD configuration issues across workflows
• Minor fixes in Python download module and Rust namespace manifest handling

🤖 Generated with Claude Code

[github-actions]

ACTION NEEDED
Lance follows the Conventional Commits specification for release automation.

The PR title and description are used as the merge commit message. Please update your PR title and description to match the specification.

For details on the error please inspect the "PR Title Check" action.

[github-actions]

Code Review

Good security hygiene PR overall. SHA-pinning GHA actions, tightening author association checks, fixing the tar path traversal (CVE-2007-4559), and escaping SQL-like filter strings are all solid improvements.

P0: Missed SQL filter escape in delete_from_manifest

The PR escapes object_id in manifest_contains_object, query_manifest_for_table, query_manifest_for_namespace, and the starts_with check in drop_namespace but misses delete_from_manifest at line 905 in rust/lance-namespace-impls/src/dir/manifest.rs. This is the same injection pattern and should get the same single-quote escaping treatment. Arguably more critical since it is a DELETE operation.

Minor: upload-artifact v3 to v4 bump in benchmarks.yml

The benchmarks.yml change pins the SHA but also bumps from upload-artifact v3 to v4. v4 has breaking changes (e.g. requires unique artifact names, different merge behavior). This should work fine here since artifact names are unique per matrix entry, but worth a sanity check that the consuming workflow still downloads correctly.

Generated with Claude Code

[Xuanwo]

Thank you for working on this! Especially thank you the effort to pin github actions.

But this PR seems to mix different changes inside the same PR. This can make this PR hard to review and cherry pick.

Would you like to split them into different PRs?

[Xuanwo]

Approve after offline discussion.

[Xuanwo]

FAILED python/tests/test_integration.py::test_duckdb_pushdown_extension_types - _duckdb.Error: DeprecationWarning: fetch_arrow_table() is deprecated, use to_arrow_table() instead.

I think it's because duckdb has a new release.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!