[nandakishore-s-13]

Description

Third-party actions in the hand-written workflows were referenced by mutable tags (@v5, @v6), so a moved or hijacked tag could run malicious code in CI. This pins them to immutable commit SHAs (with version comments, matching the generated weekly-workshop-triage.lock.yml) and hardens checkout credentials.

Related Issue

N/A

Type of Change

• 🔧 Refactor (no functional changes) — CI security hardening

Changes Made

• Pin actions/checkout (v5), actions/setup-node (v6) and actions/upload-artifact (v5) to SHAs in run-tests.yml, copilot-setup-steps.yml, bootstrap-issues.yml
• Add persist-credentials: false to checkouts that don't push (bootstrap-issues.yml still pushes, so it is unchanged)
• Add the github-actions ecosystem (7-day cooldown) to dependabot.yml so pins stay current
• weekly-workshop-triage.lock.yml is generated and untouched

Testing

Workflow/config-only change; no data-layer or frontend code touched, so unit/e2e suites are not affected. CI on this PR exercises the pinned actions.

Checklist

• My changes are focused on a single concern
• I have written clear commit messages explaining what and why

[Copilot]

🟡 Changes recommended

Dependabot can update compiler-managed github/gh-aw-actions pins independently, risking incompatible helper scripts.

1 open issue

• Exclude compiler-managed gh-aw action pins from independent updates · New

What changed in this PR

This PR hardens CI by replacing mutable GitHub Actions tags with commit SHAs and limiting checkout credential persistence.

Changes:

• Pin checkout, Node.js setup, and artifact upload actions, retaining version comments.
• Disable persisted checkout credentials where workflows do not push.
• Add weekly Dependabot updates for GitHub Actions with a seven-day cooldown.

File	Description
.github/​workflows/​run-tests.yml	Pins actions and disables persisted checkout credentials across test jobs.
.github/​workflows/​copilot-setup-steps.yml	Pins setup actions and disables persisted checkout credentials.
.github/​workflows/​bootstrap-issues.yml	Pins checkout while retaining credentials needed to push.
.github/​dependabot.yml	Adds scheduled updates for GitHub Actions dependencies.

_{Review effort: Balanced}