ci: pin GitHub Actions to commit SHAs for supply chain security

[dreamiurg]

Problem

OpenSSF Scorecard gives 0/10 for Pinned-Dependencies because GitHub Actions are referenced by mutable version tags (e.g., @v5) instead of immutable commit SHAs.

Solution

Pin all GitHub Actions to specific commit SHAs to prevent supply chain attacks. Each pinned SHA includes a comment with the original version tag for maintainability.

Pinned Actions

• actions/checkout@v5 → @08c6903...
• actions/create-github-app-token@v2 → @6701853...
• actions/setup-python@v6 → @e797f83...
• actions/upload-artifact@v4 → @ea165f8...
• amannn/action-semantic-pull-request@v6 → @48f2562...
• astral-sh/setup-uv@v7 → @8585678...
• codecov/codecov-action@v5 → @5a10915...
• github/codeql-action/*@v3 → @5d5cd55...
• github/codeql-action/*@v4 → @0499de3...
• ossf/scorecard-action@v2.4.3 → @4eaacf0...
• pypa/gh-action-pypi-publish@release/v1 → @ed0c539...

Expected Impact

Pinned-Dependencies score: 0 → 10

This will improve the overall OpenSSF Scorecard from 6.5/10 to 7.5/10.

Testing

All workflow files validated by yamllint. CI tests will verify workflows still function correctly with pinned SHAs.

Maintenance

When updating action versions:

1. Get the commit SHA for the new version tag
2. Update both the SHA and the version comment
3. Example: uses: actions/checkout@<new-sha> # v6

Dependabot will notify when actions have new releases, but won't auto-update pinned SHAs.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@dreamiurg has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 22 minutes and 15 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between a13ecdf and 134de86.

📒 Files selected for processing (4)

• .github/workflows/ci.yml (4 hunks)
• .github/workflows/codeql.yml (1 hunks)
• .github/workflows/release.yml (2 hunks)
• .github/workflows/scorecard.yml (1 hunks)

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch security/pin-github-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.21%. Comparing base (b91f173) to head (134de86).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #56   +/-   ##
=======================================
  Coverage   91.21%   91.21%           
=======================================
  Files           8        8           
  Lines        1081     1081           
=======================================
  Hits          986      986           
  Misses         95       95           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.