fix: pin GitHub Actions to commit SHAs

[PrekshithD-Microsoft]

This pull request updates all GitHub Actions used in the repository's workflow files to reference specific commit SHAs instead of version tags. This change improves security and reliability by ensuring that workflows always use the exact, reviewed version of each action, preventing unexpected changes from upstream updates.

The most important changes are:

Security and Reliability Improvements:

• All GitHub Actions in workflow files (such as actions/checkout, actions/setup-python, azure/login, docker/build-push-action, and others) are now pinned to specific commit SHAs rather than floating version tags. This prevents accidental or malicious changes from upstream action updates. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33]

Affected Workflow Areas:

• The updates cover a wide range of workflows, including build, deployment, Docker image creation, Azure login, Python setup, stale bot, artifact upload, and various validation and test automation workflows. (see references above)

Consistency Across the Repository:

• All workflows now consistently use SHA-pinned actions, reducing the risk of inconsistent behavior between jobs or environments. (see references above)## Purpose

• ...

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[github-actions]

Tests	Skipped	Failures	Errors	Time
1	0 💤	0 ❌	1 🔥	4.958s ⏱️

[Copilot]

Pull request overview

This pull request hardens the repository’s GitHub Actions workflows by replacing floating action version tags with commit-SHA pins, improving supply-chain security and making CI/CD behavior deterministic across runs.

Changes:

• Pinned common actions (e.g., actions/checkout, actions/setup-python, actions/upload-artifact, azure/login, Docker actions) to specific commit SHAs.
• Added inline version comments (e.g., # v6, # v3) alongside pinned SHAs to preserve readability and upgrade intent.
• Applied the pinning consistently across build, test, validation, deployment, and automation workflows.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/validate-bicep-params.yml	Pins checkout/setup-python/upload-artifact to SHAs for deterministic bicep param validation runs.
.github/workflows/test.yml	Pins checkout/setup-python to SHAs for stable test workflow execution.
.github/workflows/test-automation.yml	Pins checkout/setup-python/azure-login/upload-artifact to SHAs for repeatable automation runs.
.github/workflows/test-automation-v2.yml	Pins checkout/setup-python/azure-login/upload-artifact to SHAs for repeatable automation v2 runs.
.github/workflows/telemetry-template-check.yml	Pins checkout to a SHA to stabilize template checks.
.github/workflows/stale-bot.yml	Pins stale/checkout/upload-artifact to SHAs to reduce supply-chain risk in maintenance automation.
.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml	Pins checkout to a SHA for scheduled Dependabot auto-merge workflow determinism.
.github/workflows/pylint.yml	Pins checkout/setup-python to SHAs for consistent lint runs.
.github/workflows/pr-title-checker.yml	Pins semantic PR title checker action to a SHA for deterministic PR policy checks.
.github/workflows/job-docker-build.yml	Pins checkout/docker actions/azure-login to SHAs for consistent container build/push jobs.
.github/workflows/job-deploy.yml	Pins checkout/azure-login to SHAs for deterministic deployment jobs.
.github/workflows/job-deploy-windows.yml	Pins checkout/setup-azd/azure-login to SHAs for stable Windows deployment jobs.
.github/workflows/job-deploy-linux.yml	Pins checkout/setup-azd/azure-login to SHAs for stable Linux deployment jobs.
.github/workflows/job-cleanup-deployment.yml	Pins azure-login to a SHA for deterministic cleanup operations.
.github/workflows/deploy.yml	Pins checkout/azure-login to SHAs across deployment jobs for consistent auth + execution.
.github/workflows/build-docker.yml	Pins checkout/azure-login/docker actions to SHAs for deterministic Docker builds.
.github/workflows/broken-links-checker.yml	Pins checkout/lychee-action to SHAs to stabilize link-check automation.
.github/workflows/azure-dev.yml	Pins checkout/setup-azd/azure-login to SHAs for deterministic dev environment workflow runs.
.github/workflows/azd-template-validation.yml	Pins checkout/template-validation-action to SHAs for consistent azd template validation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.