ci: pin license-header-checker to fix flaky install step

.github/workflows/license-header-check.yml

@@ -22,11 +22,18 @@ jobs:
       - name: Check out code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Install license-header-checker
+        env:
+          # Pin to a specific release and download the asset directly from the
+          # release CDN. This avoids the flaky dynamic "latest" tag lookup in the
+          # upstream install.sh (it fetches the releases page and parses tag_name,
+          # which intermittently returns empty and fails the job).
+          LHC_VERSION: "1.5.0"
         run: |
           set -euo pipefail
-          curl -sfSL https://raw.githubusercontent.com/lluissm/license-header-checker/master/install.sh -o /tmp/install-lhc.sh
-          bash /tmp/install-lhc.sh
-          rm -f /tmp/install-lhc.sh
+          mkdir -p ./bin
+          curl -sfSL "https://github.com/lluissm/license-header-checker/releases/download/v${LHC_VERSION}/license-header-checker_${LHC_VERSION}_linux_amd64.tar.gz" -o /tmp/lhc.tar.gz
+          tar -xzf /tmp/lhc.tar.gz -C ./bin license-header-checker
+          rm -f /tmp/lhc.tar.gz
       - name: Check license headers (rust)
         run: ./bin/license-header-checker -a -v ./rust/license_header.txt rust rs && [[ -z `git status -s` ]]
       - name: Check license headers (python)