Pin GitHub Actions to full-length commit SHAs and apply supply chain hardening

[data-douser]

Summary

All GitHub Actions referenced in .github/workflows/ and .github/actions/ should be pinned to their full 40-character commit SHA (instead of mutable tags like @v6) to ensure immutable, tamper-resistant CI/CD references. Additional supply chain hardening measures should also be applied.

This follows the same patterns already applied to codeql-development-mcp-server in:

• Pin actions to full-length commit SHAs codeql-development-mcp-server#190 (pin actions to full-length commit SHAs)
• Supply chain hardening for npm and actions codeql-development-mcp-server#258 (supply chain hardening for npm and actions)

Actions to Pin

The following external action references currently use mutable tags and need to be pinned to their corresponding commit SHAs:

.github/workflows/copilot-setup-steps.yml

• actions/checkout@v6

.github/workflows/lint-and-format.yml

• actions/checkout@v6
• actions/setup-node@v6

.github/workflows/codeql-qlt-unit-tests.yml

• actions/checkout@v6 (×3)
• actions/upload-artifact@v7
• actions/download-artifact@v8

.github/actions/setup-codeql-environment/action.yml

• actions/cache@v4 (×4)
• actions/setup-node@v6
• actions/setup-python@v6 (×2)
• actions/setup-java@v5 (×2)
• actions/setup-go@v6 (×2)
• actions/setup-dotnet@v5
• ruby/setup-ruby@v1 (×2)
• advanced-security/codeql-development-toolkit/.github/actions/install-qlt@main — currently pinned to main branch, should also use a SHA

Format

Each pinned reference should use the format:

uses: actions/checkout@<full-40-char-sha>  # v6

The trailing comment preserves the human-readable tag for maintainability.

Additional Supply Chain Hardening (optional, same PR or follow-up)

• Add a .github/instructions/ file for actions/workflows that enforces SHA-pinning guidance for Copilot (similar to github_workflows_yaml.instructions.md in the MCP server repo)
• Review workflow permissions to ensure least-privilege (permissions: blocks)
• Consider adding Dependabot configuration for GitHub Actions version updates
• Setup completed to allow setting Require actions to be pinned to a full-length commit SHA in repo admin settings for actions.

Acceptance Criteria

• All external GitHub Actions in .github/workflows/*.yml and .github/actions/**/*.yml are pinned to full commit SHAs with tag comments
• No action references use mutable tags (@v6, @v1, @main, etc.)
• CI/CD workflows continue to pass after the change