feat(ci): pin third-party GitHub Actions to commit SHAs

[konokenj]

Problem

.github/workflows/*.yml reference GitHub Actions by tag (e.g. actions/checkout@v6, EndBug/add-and-commit@v10.0.0, googleapis/release-please-action@v5, amannn/action-semantic-pull-request@v6, dependabot/fetch-metadata@v3). Tags are mutable: if a maintainer's account is compromised, or a tag is force-moved, the workflow silently runs different action code on the next run. Some of these workflows have write permissions on the repository (e.g. update_snapshot.yml has contents: write and installs from PR-controlled pnpm-workspace.yaml), so a swapped action can exfiltrate secrets or push malicious commits.

Proposed solution

Pin all third-party GitHub Actions to full-length commit SHAs. Dependabot's github-actions updater already supports SHA pinning and will keep them current with monthly PRs. Keep the tag reference in a comment for readability. Example:

- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v6.0.0

First-party actions/* are lower risk (GitHub-controlled) but pinning them is cheap and removes the "which are trusted vs. not" judgement from the maintainer. Dependabot's group setting can bundle the SHA bumps into one PR per group.

Evidence of general need

• OpenSSF Scorecards flags "Pinned-Dependencies" for exactly this reason
• The 2022 tj-actions/changed-files compromise was propagated via mutable tags across thousands of repositories

Alternatives considered

• Rely on GitHub's dependabot/renovate policy alone — does not defend against tag movement between updater runs

Discovered in the v3 diff review (executor 06 finding F-CI-02).

[konokenj]

Closing per repository owner directive (2026-07-22): code-review-originated issues are not accepted. The finding is documented in the executor 06 review report at .kiro/specs/v3-release-prep/review-diff-report.md for future reference.

[konokenj]

Reopening after maintainer triage of the v3 release code review: accepted into the v3-fix milestone as a discussion item — the direction needs to be decided before implementation. See the discussion points below.

[konokenj]

Maintainer triage — scope note and design points:

• update_snapshot.yml is being removed in the v3 release fixes, which drops EndBug/add-and-commit from the pinning scope. Remaining third-party actions: actions/checkout, actions/setup-node, actions/stale, actions/github-script, googleapis/release-please-action, amannn/action-semantic-pull-request, dependabot/fetch-metadata.
• If we pin, configure Dependabot's github-actions updater to keep SHAs current (it supports SHA + version comment).
• A legitimate outcome of the discussion is to pin only non-GitHub-owned actions and leave actions/* on tags.