Pin all GitHub Actions to SHA-based references

[brendandburns]

Summary

Switches all GitHub Actions workflow references from mutable tag-based references (e.g. actions/checkout@v6) to immutable SHA-pinned references (e.g. actions/checkout@de0fac2e... # v6), with the original tag preserved as a trailing comment for readability.

Motivation

Using mutable tags in GitHub Actions workflows is a supply chain security risk. Tags are Git refs that can be force-pushed by repository owners (or attackers who compromise an action's repository), meaning a tag like v6 can be silently repointed to arbitrary code at any time. This enables a class of attack where a compromised or malicious action version is injected into CI/CD pipelines without any visible change to the consuming workflow files.

This is not a theoretical risk. In the LiteLLM security incident, attackers exploited mutable tag references to the aquasecurity/trivy-action GitHub Action. A compromised version of the action was published under the same tag, which caused CI/CD pipelines that referenced it by tag to silently execute malicious code — exfiltrating secrets and environment variables from every repository that used the action.

Pinning to commit SHAs makes workflow references immutable and tamper-proof. Even if an upstream action repository is compromised and tags are repointed, SHA-pinned references will continue to resolve to the originally audited code.

This change follows the security policy recommended by the Kubernetes GitHub Actions Policy and GitHub's own security hardening guidance.

Changes

All 12 workflow files under .github/workflows/ have been updated. Every uses: directive now references a full 40-character commit SHA with the original version tag preserved as a comment. No functional changes — all SHAs resolve to the same code as the previously referenced tags.

Microsoft Reviewers: Open in CodeFlow

[shenglol]

Might be worth adding a comment explaining the rationale behind this change?