ci, ledger: Pin Ledger app versions for compatibility

Pin app-bitcoin-new to v2.4.4 (tag stax_1.9.0_2.4.4_sdk_...) since
newer versions may be incompatible with Speculos v0.25.10 which is
the last version supporting Python 3.9.

Use shallow clone (--depth 1) for both Ledger apps to speed up builds.

Author: Sjors

.github/workflows/ledger-app-builder.yml

@@ -11,10 +11,12 @@ jobs:
   build:
     name: Build Bitcoin App
     runs-on: ${{ inputs.runs-on }}
-    container: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest
+    # Pin to 4.23.0 for SDK v25.9.0 compatibility with Speculos v0.25.10
+    container: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:4.23.0
     steps:
       - run: |
-          git clone https://github.com/LedgerHQ/app-bitcoin-new.git
+          # Pin to v2.4.1 - last version that worked with HWI CI (PR #795 merged Sept 2025)
+          git clone --branch 2.4.1 --depth 1 https://github.com/LedgerHQ/app-bitcoin-new.git
           cd app-bitcoin-new
           make DEBUG=1 BOLOS_SDK=$NANOX_SDK
       - uses: actions/upload-artifact@v4

.github/workflows/ledger-legacy-app-builder.yml

@@ -11,10 +11,12 @@ jobs:
   build:
     name: Build Bitcoin Legacy App
     runs-on: ${{ inputs.runs-on }}
-    container: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest
+    # Pin to 4.23.0 for SDK v25.9.0 compatibility with Speculos v0.25.10
+    container: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:4.23.0
     steps:
       - run: |
-          git clone https://github.com/LedgerHQ/app-bitcoin.git -b legacy-1.6.6
+          # Pin to legacy-1.6.6 HEAD commit for reproducibility
+          git clone --depth 1 https://github.com/LedgerHQ/app-bitcoin.git -b legacy-1.6.6
           cd app-bitcoin
           make DEBUG=1 BOLOS_SDK=$NANOSP_SDK
       - uses: actions/upload-artifact@v4