ci: pin remaining GitHub Actions and all Docker base images to immutable references

[Brendan Walsh (BrendanWalsh)]

Why

Floating references are mutable. @master, @v2.x, and a bare image tag can all be repointed at new code by whoever controls the upstream — the classic tag-hijack supply-chain attack. Immutable references (commit SHAs, image digests) remove that class of risk and make builds reproducible.

This also closes the OpenSSF Scorecard Pinned-Dependencies check.

Most of the repo was already pinned by earlier work. This PR closes the last three unpinned/imprecise references and pins the Docker base images.

What changed

GitHub Actions — 3 workflows

Workflow	Was	Now	Note
ado-pr-to-workitem.yml	danhellem/…@master	@496254e4… # master	floating branch → frozen
remove-awaiting-response-label.yml	octokit/request-action@v2.x	@02f5e7c6… # v2.x	floating branch → frozen
scorecards.yml	codeql-action/upload-sarif@d1ba80a1… # v4	@5595ccaf… # v4.37.6	already a SHA; moved to the exact release already used by codeql.yml, and relabelled with the precise version

The first two upstreams publish no semver tags, so the pin tracks a branch head frozen at a known-good commit.

Docker base images — 8 Dockerfiles

Tags are kept alongside the digest (image:tag@sha256:…) so the intended version stays readable.

Image	Digest	Files
mirror/docker/library/ubuntu:22.04	sha256:104ae837…d813da2fb	tools/docker/{demo,minimal}
openjdk/jdk:11-mariner	sha256:eea2eae2…d4bfc7c7	tools/helm/{livy,spark,spark/mini,zeppelin}
mmlspark/spark2.4:v4_mini	sha256:a7da0d7c…1a389279	tools/helm/{livy/mini,zeppelin/mini}

The ubuntu and openjdk pins target the multi-arch OCI index digest, which is the correct thing for FROM.

Verification

Every reference was resolved against the live GitHub and MCR registry APIs — 11 of 11 confirmed to match the version in its trailing comment:

• Branch-head pins verified as the current HEAD of master / v2.x.
• 5595ccaf… verified by dereferencing annotated tag v4.37.6; it is the direct child of the previous d1ba80a1…, i.e. a one-release forward move inside major v4 — not a downgrade or cross-major jump.
• Each digest checked both by-digest (exists) and by-tag (tag still resolves to it).

Impact

No functional change — every pin resolves to the same code and images CI was already running.

Trade-off worth naming: the two branch-head pins no longer receive upstream fixes automatically and must be refreshed by hand or by Dependabot. That is the intended effect of pinning, not a defect.

Checklist

• Does not change dependencies (no build.sbt / manifest change)
• Not a new feature — no website samples needed
• No user-facing behavior change

[github-actions]

Hey Brendan Walsh (@BrendanWalsh) 👋!
Thank you so much for contributing to our repository 🙌.
Someone from SynapseML Team will be reviewing this pull request soon.

We use semantic commit messages to streamline the release process.
Before your pull request can be merged, you should make sure your first commit and PR title start with a semantic prefix.
This helps us to create release messages and credit you for your hard work!

Examples of commit messages with semantic prefixes:

• fix: Fix LightGBM crashes with empty partitions
• feat: Make HTTP on Spark back-offs configurable
• docs: Update Spark Serving usage
• build: Add codecov support
• perf: improve LightGBM memory usage
• refactor: make python code generation rely on classes
• style: Remove nulls from CNTKModel
• test: Add test coverage for CNTKModel

To test your commit locally, please follow our guild on building from source.
Check out the developer guide for additional guidance on testing your change.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/github/codeql-action/upload-sarif	5595ccaf912efad79be6eef63a5619ff05969be3	Unknown	Unknown

Scanned Files

• .github/workflows/scorecards.yml

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.81%. Comparing base (2c21cf2) to head (ecd9a5b).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2533      +/-   ##
==========================================
- Coverage   87.05%   86.81%   -0.24%     
==========================================
  Files         338      338              
  Lines       18843    18843              
  Branches     1805     1805              
==========================================
- Hits        16403    16359      -44     
- Misses       2440     2484      +44     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Rana Singh (ranadeepsingh)]

Thanks for driving this one through, Brendan Walsh (@BrendanWalsh)! Pinning every action and base image to an immutable digest closes a real supply-chain gap, and the eight Dockerfiles were the part that's easy to forget. Appreciate the follow-through. 🚀