Pin create-dmg version in signed build workflows (#401)

* Pin create-dmg version in release workflows

* Bump pinned create-dmg to 8.0.0

.github/workflows/ci.yml

@@ -16,6 +16,9 @@ jobs:
       - name: Validate self-hosted runner guards
         run: ./tests/test_ci_self_hosted_guard.sh
 
+      - name: Validate create-dmg version pinning
+        run: ./tests/test_ci_create_dmg_pinned.sh
+
   web-typecheck:
     runs-on: ubuntu-latest
     defaults:

.github/workflows/nightly.yml

@@ -15,6 +15,9 @@ on:
 permissions:
   contents: write
 
+env:
+  CREATE_DMG_VERSION: 8.0.0
+
 jobs:
   decide:
     runs-on: ubuntu-latest
@@ -112,7 +115,7 @@ jobs:
         run: |
           brew update
           brew install zig
-          npm install --global create-dmg
+          npm install --global "create-dmg@${CREATE_DMG_VERSION}"
 
       - name: Build GhosttyKit.xcframework
         run: |

.github/workflows/release.yml

@@ -9,6 +9,9 @@ on:
 permissions:
   contents: write
 
+env:
+  CREATE_DMG_VERSION: 8.0.0
+
 jobs:
   build-sign-notarize:
     runs-on: self-hosted
@@ -101,7 +104,7 @@ jobs:
         run: |
           brew update
           brew install zig
-          npm install --global create-dmg
+          npm install --global "create-dmg@${CREATE_DMG_VERSION}"
 
       - name: Download Metal Toolchain
         if: steps.guard_release_assets.outputs.skip_all != 'true'