Pin GitHub Actions to immutable commit SHAs

[Copilot]

Using mutable references like @v4 or @master allows action code to change without review. If an action author's account is compromised, pipelines are vulnerable to supply chain attacks.

Changes

Pinned all GitHub Actions across 6 workflows to immutable commit SHAs with version comments:

• release.yml: actions/checkout@v6, Adyen/release-automation-action@v1.3.1
• python-ci.yml: actions/checkout@v6, actions/setup-python@v6
• labeler_workflow.yml: actions/checkout@v6, actions/setup-python@v6, actions/labeler@v6
• stale.yml: actions/stale@v9
• label_new_issues.yml: actions-ecosystem/action-add-labels@v1
• pypipublish.yml: actions/checkout@master, actions/setup-python@v6, pypa/gh-action-pypi-publish@release/v1

Format

# Before
uses: actions/checkout@v4

# After
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4

Version comments preserve original reference for maintainability while SHAs provide security.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Bug]: Pin GitHub Actions to immutable commit SHAs</issue_title>
<issue_description>Using tags like @v1, @master, or @latest allows the action code to change without your review. If the action author is compromised, your pipeline is compromised.
Pin to the immutable Commit SHA.

❌ Bad

uses: actions/checkout@v4

✅ Good

uses: actions/checkout@b4ffde6 # v4.1.1

All existing workflows shall be updated to pin the version of the actions to a specific commit SHA.

</issue_description>

<agent_instructions>Update all workflows to pin the actions to the corresponding SHA commit, instead of using the version number</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes [Bug]: Pin GitHub Actions to immutable commit SHAs #405

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud