Harden CI supply chain by pinning GitHub Actions to immutable SHAs

[Copilot]

This PR addresses workflow supply-chain exposure from mutable action tags (@v*) in repository CI/CD. It replaces tag-based action references with commit-pinned SHAs across core automation workflows.

• Scope

  • Convert uses: owner/action@vX to uses: owner/action@<commit-sha> for repository workflows handling code scanning, linting, dependency review, pages deploy, labeling, stale management, greetings, and meetup automation.

• Workflow updates

  • Pinned action refs in:
    • codeql1.yml
    • dependency-review.yml
    • greetings.yml
    • label.yml
    • powershell.yml
    • stale.yml
    • static.yml
    • super-linter.yml
    • update-meetup.yml

• Implementation pattern

  • Preserve readability by keeping semver intent as inline comments while enforcing immutable execution targets.

# before
- uses: actions/checkout@v4

# after
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	34e114876b0b11c390a56381ad16ebd13914f8d5	🟢 5.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Maintained ⚠️ 2 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Fuzzing ⚠️ 0 project is not fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 License 🟢 10 license file detected Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 8 SAST tool detected but not run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches
actions/github/codeql-action/upload-sarif	8aad20d150bbac5944a9f9d289da16a4b0d87c1e	Unknown	Unknown
actions/actions/checkout	34e114876b0b11c390a56381ad16ebd13914f8d5	🟢 5.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Maintained ⚠️ 2 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Fuzzing ⚠️ 0 project is not fuzzed Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 License 🟢 10 license file detected Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 8 SAST tool detected but not run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches
actions/actions/setup-python	a26af69be951a213d495a4c3e4e4022e16d87065	🟢 5	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 0 1 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9

Scanned Files

• .github/workflows/powershell.yml
• .github/workflows/update-meetup.yml

[Copilot]

Pull request overview

This PR hardens the repository’s CI/CD supply chain by replacing mutable GitHub Action version tags (e.g., @v4) with immutable commit-SHA pins across multiple GitHub Actions workflows.

Changes:

• Pinned commonly used GitHub Actions (checkout, setup-python, CodeQL, Pages deploy, etc.) to full commit SHAs while preserving the intended version as inline comments.
• Pinned third-party actions (e.g., super-linter) to immutable SHAs to reduce exposure to tag retargeting.
• Standardized the “pinned SHA + semver comment” pattern across the affected workflows.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/codeql1.yml	Pins CodeQL workflow actions (checkout/init/analyze) to immutable SHAs.
.github/workflows/dependency-review.yml	Pins checkout and dependency-review-action to immutable SHAs.
.github/workflows/greetings.yml	Pins first-interaction action to an immutable SHA.
.github/workflows/label.yml	Pins github-script and labeler actions to immutable SHAs.
.github/workflows/powershell.yml	Pins checkout and CodeQL SARIF upload action to immutable SHAs.
.github/workflows/stale.yml	Pins stale action to an immutable SHA.
.github/workflows/static.yml	Pins Pages deploy-related actions to immutable SHAs.
.github/workflows/super-linter.yml	Pins checkout and super-linter action to immutable SHAs.
.github/workflows/update-meetup.yml	Pins checkout and setup-python to immutable SHAs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.