Pin GitHub Actions to immutable commit SHAs

[Copilot]

Mutable action references (@v1, @master, @latest) allow code changes without review. If an action author is compromised, the entire CI/CD pipeline is compromised.

Changes

Pinned all GitHub Actions to immutable commit SHAs with inline version comments for reference:

Workflow files updated:

• codeql.yml - actions/checkout, github/codeql-action (init, autobuild, analyze)
• release.yml - actions/checkout, Adyen/release-automation-action
• stale.yml - actions/stale
• label_new_issues.yml - actions-ecosystem/action-add-labels
• ruby.yml - actions/checkout, ruby/setup-ruby
• rubygems_release.yml - actions/checkout, cadwallion/publish-rubygems-action

Example:

# Before
- uses: actions/checkout@v6

# After
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

Total: 12 actions pinned across 6 workflows.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Bug]: Pin Workflow Actions</issue_title>
<issue_description>We have recently conducted a security scan of our GitHub repositories to ensure our CI/CD pipelines are secure. We identified misconfigurations in GitHub Actions workflows (e.g., injection risks, unpinned actions).

Steps to reproduce

Using tags like @v1, @master, or @latest allows the action code to change without your review. If the action author is compromised, your pipeline is compromised.
Pin to the immutable Commit SHA.

❌ Bad

uses: actions/checkout@v4

✅ Good

uses: actions/checkout@b4ffde6 # v4.1.1

All existing workflows shall be updated to pin the version of the actions to a specific commit SHA.
</issue_description>

<agent_instructions>Update all workflows to pin the actions to the corresponding SHA commit, instead of using the version number</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes [Bug]: Pin Workflow Actions #335

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gcatanese]

Looks good