ci(security): pin workflow actions to commit SHAs

[Yogeshwar-Pawade]

Summary

Follow-up to the zizmor findings on #682. Pins the six third-party actions referenced in .github/workflows/backport.yaml and .github/workflows/base-images.yaml to full commit SHAs so a compromised or hijacked tag can't swap out the referenced code. Version comments are retained for readability.

Action	SHA	Version
sorenlouv/backport-github-action	ad888e978060bc1b2798690dd9d03c4036560947	v9.5.1
actions/checkout	11d5960a326750d5838078e36cf38b85af677262	v4
docker/setup-buildx-action	8d2750c68a42422c14e847fe6c8ac0403b4cbd6f	v3
docker/bake-action	5be5f02ff8819ecd3092ea6b2e6261c31774f2b4	v6
actions/upload-artifact	ea165f8d65b6e75b540449e92b4886f43607fa02	v4
actions/download-artifact	d3f86a106a0bac45b974a628896c90dbdf5c8093	v4

Per Santhosh's DM guidance, this PR scopes to unpinned-uses only. Remaining zizmor findings from the #682 run:

• template-injection in base-images.yaml — inputs come from workflow_dispatch (maintainer-triggered), not attacker-controllable; can be addressed separately if we want to appease the linter (move inputs into env: and reference ${VAR}).
• dangerous-triggers on backport.yaml — pull_request_target is required by design for the auto-backport flow.

Test plan

• Zizmor re-scan shows the six unpinned-uses findings gone.

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	14
Total	14

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: CanvOS/.github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

template-injection — High (13 similar finding(s))

code injection via template expansion

File: CanvOS/.github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 74–165 (cols 8–13) — this step
• Line 81 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 76 (cols 8–11) — this run block
• Line 82 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 83 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 84 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 85 (cols 35–72) — expression github.event.inputs.kairos_init_image — may expand into attacker-controllable code
• Line 86 (cols 32–66) — expression github.event.inputs.hadron_version — may expand into attacker-controllable code
• …and 9 more location(s) in this file.

Please review these findings before merging.

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	14
Total	14

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: CanvOS/.github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

template-injection — High (13 similar finding(s))

code injection via template expansion

File: CanvOS/.github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 74–165 (cols 8–13) — this step
• Line 81 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 76 (cols 8–11) — this run block
• Line 82 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 83 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 84 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 85 (cols 35–72) — expression github.event.inputs.kairos_init_image — may expand into attacker-controllable code
• Line 86 (cols 32–66) — expression github.event.inputs.hadron_version — may expand into attacker-controllable code
• …and 9 more location(s) in this file.

Please review these findings before merging.

does not seem right