Pin yq installation to a specific version via a shared composite action

.github/actions/install-yq/action.yaml

@@ -0,0 +1,18 @@
+name: Install yq
+description: Install mikefarah/yq at a pinned version
+
+inputs:
+  version:
+    description: "yq version to install"
+    required: false
+    default: "4.53.3"
+
+runs:
+  using: composite
+  steps:
+    - name: Install yq v${{ inputs.version }}
+      shell: bash
+      run: |
+        sudo wget -qO /usr/local/bin/yq \
+          "https://github.com/mikefarah/yq/releases/download/v${{ inputs.version }}/yq_linux_amd64"
+        sudo chmod +x /usr/local/bin/yq

.github/workflows/pre-release.yaml

@@ -73,6 +73,8 @@ jobs:
           fi
           git checkout -b "${PRE_RELEASE_BRANCH}"
 
+      - uses: ./.github/actions/install-yq
+
       - name: Update release.yaml
         run: |
           VERSION="${{ needs.setup.outputs.version }}"

.github/workflows/release.yaml

@@ -23,11 +23,7 @@ jobs:
         with:
           ref: ${{ inputs.release-branch }}
 
-      - name: Install yq
-        run: |
-          sudo wget -qO /usr/local/bin/yq \
-            https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
-          sudo chmod +x /usr/local/bin/yq
+      - uses: ./.github/actions/install-yq
 
       - name: Parse version from release.yaml
         id: parse

.github/workflows/version-gate.yaml

@@ -16,11 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
 
-      - name: Install yq
-        run: |
-          sudo wget -qO /usr/local/bin/yq \
-            https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
-          sudo chmod +x /usr/local/bin/yq
+      - uses: ./.github/actions/install-yq
 
       - name: Validate release.yaml
         env: