workflows: Pin GitHub Actions to commit hashes

[jtrobles-cdd]

A Git tag is mutable, so actions/checkout@v7.0.0 resolves to whatever commit the tag points at when the workflow runs, and an account takeover or a compromised release is enough to move it. These workflows hold the credentials that publish the package to PyPI, so code substituted that way would run with them. Commit 933eeb0 already did this for codecov/codecov-action, prompted by a code scanning alert, and this extends it to the rest of them.

Scope

• Every reference to a third-party Action now carries the full commit hash with the friendly version in a trailing comment, in the same form codecov/codecov-action already used.
• No version changes: each hash is the one the tag already in use resolves to, so the Actions that run are the same ones that ran before.
• The reusable workflows of cordada/github-actions-utils keep referencing master, as they are internal to the organization and the branch is the reference the callers are meant to track.
• The ./.github/workflows/*.yaml calls in ci-cd.yaml are same-repository references and take no version.

Code scanning

• The two open actions/unpinned-tag alerts, 5 and 6, are about the two cordada/github-actions-utils@master references, so they stay open after this. Nothing was flagged for the actions/* references this pull request pins, which is why it closes no alert.

Dependabot

• .github/dependabot.yml needs no change: Dependabot updates a hash reference the same way it updates a tag, and rewrites the comment along with it, as long as the friendly version follows the hash as a comment. That is the form used here.

How the hashes were obtained

• Each one comes from the GitHub API for the tag already in use, dereferencing an annotated tag to the commit it points at. Applying the same method to codecov-action@v7.0.0 reproduces the hash already committed for it, which is how the method was checked.

Not verified

• The YAML linter that gates this repository is Super-Linter, run through a reusable workflow, and it was not run locally. What was checked instead is that all seven workflow files still parse and that no changed line exceeds the 100-character limit of .editorconfig.
• actions/download-artifact is used only by deploy.yaml, which runs on master, so no check on this pull request exercises that pin. It will first run during the next deployment.

Reference

• Same change in lib-cl-sii-python: workflows: Pin GitHub Actions to commit hashes lib-cl-sii-python#1065

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud