Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins direct external GitHub Actions references to immutable commit SHAs while preserving their current versions and channels in comments.

Conflict resolution

• Incorporated current main (71ef8266) without reverting upstream changes.
• Reapplied 34 pins across 12 workflows, preserving the current CodeQL v4.38.2 steps, Docker publish jobs, newer action versions, and existing SHA pins.
• Preserved reusable-workflow calls and same-repository references.
• Retained the seven-day GitHub Actions Dependabot cooldown and every existing update entry, including the new npm entry for /ui.

Validation

• Resolved current-base action tags/branches through the GitHub API.
• Verified workflow semantics are unchanged except for action references and Dependabot entries are preserved.
• Verified exact remote contents and the diff against current main; the branch includes both its previous head and current base, with zero commits behind.
• No application fixes or policy changes. CI results remain visible in the PR checks; conflict resolution does not claim that all checks pass.

[Copilot]

🟡 Changes recommended

The local build-ui composite action still contains two mutable external action references.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Pins direct workflow action dependencies to immutable SHAs and adds a Dependabot update cooldown.

Changes:

• Pins 34 workflow action references with version comments.
• Adds a seven-day GitHub Actions cooldown.

File summaries

File	Description
.github/workflows/registry-releaser.yml	Pins checkout and Go setup.
.github/workflows/moderator.yml	Pins checkout and moderation actions.
.github/workflows/mcp-diff.yml	Pins checkout and Go setup.
.github/workflows/lint.yml	Pins lint workflow actions.
.github/workflows/license-check.yml	Pins license-check actions.
.github/workflows/goreleaser.yml	Pins release and attestation actions.
.github/workflows/go.yml	Pins build workflow actions.
.github/workflows/docs-check.yml	Pins documentation-check actions.
.github/workflows/docker-publish.yml	Pins checkout and cache actions.
.github/workflows/code-scanning.yml	Pins CodeQL and setup actions.
.github/workflows/close-inactive-issues.yml	Pins the stale action.
.github/workflows/ai-issue-assessment.yml	Pins checkout.
.github/dependabot.yml	Adds a seven-day cooldown.

Review details

• Files reviewed: 13/13 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tiagovilasboas]

Staff AppSec (Actions SHA pinning)

Verdict: Approve with a small follow-up (conversation comment — formal review UI often disabled here.)

Pinning 34 workflow uses: refs to full commit SHAs (+ Dependabot github-actions 7-day cooldown) is the right supply-chain default: tag retargets can no longer silently change CI. Comment style is Dependabot-friendly.

Please follow up (or amend): .github/actions/build-ui/action.yml still uses mutable actions/cache@v5 and actions/setup-node@v6. That composite is on the hot path for go/lint/docs/license/code-scanning/goreleaser/mcp-diff — pinning workflows alone leaves a second mutable hop. Same # vX.Y.Z comment style as the rest of this PR.

Otherwise LGTM from AppSec.