update actions to use commit hash

[GarrettBeatty]

Issue #, if available: DOTNET-8045

Description of changes:
Update workflows to be pinned to sha. This is following the best practices https://www.stepsecurity.io/blog/pinning-github-actions-for-enhanced-security-a-complete-guide#:~:text=Action%20pinning%20with%20specific%20commit,point%20to%20different%20code%20versions

Created 2 scripts to update everything

Convert tag to commit

# Requires GitHub CLI to be installed and authenticated

function Convert-TagToCommit {
    param (
        [string]$owner,
        [string]$repo,
        [string]$tag
    )
    
    try {
        $result = gh api "repos/$owner/$repo/git/refs/tags/$tag" | ConvertFrom-Json
        return $result.object.sha
    }
    catch {
        Write-Warning "Could not resolve tag $tag for $owner/$repo"
        return $null
    }
}

# Get all workflow files
$workflowFiles = Get-ChildItem -Path ".github/workflows" -Filter "*.yml" -Recurse

foreach ($file in $workflowFiles) {
    $content = Get-Content $file.FullName -Raw
    $modified = $false
    
    # Regular expression to match GitHub Action uses statements with tags
    $regex = 'uses:\s+([\w-]+)/([\w-]+)@(v?\d+\.?\d*\.?\d*)'
    
    $matches = [regex]::Matches($content, $regex)
    
    foreach ($match in $matches) {
        $owner = $match.Groups[1].Value
        $repo = $match.Groups[2].Value
        $tag = $match.Groups[3].Value
        
        Write-Host "Found action: $owner/$repo@$tag"
        
        $commitSha = Convert-TagToCommit -owner $owner -repo $repo -tag $tag
        
        if ($commitSha) {
            Write-Host "Updating $owner/$repo@$tag to $commitSha"
            $content = $content.Replace("$owner/$repo@$tag", "$owner/$repo@$commitSha")
            $modified = $true
        }
    }
    
    if ($modified) {
        Write-Host "Writing changes to $($file.FullName)"
        $content | Set-Content $file.FullName -NoNewline
    }
}

Add comment to the action

# Requires GitHub CLI to be installed and authenticated

function Get-ActionVersion {
    param (
        [string]$owner,
        [string]$repo,
        [string]$sha
    )
    
    try {
        # First try to find the tag that points to this commit
        $tags = gh api "repos/$owner/$repo/tags" | ConvertFrom-Json
        $matchingTag = $tags | Where-Object { $_.commit.sha.StartsWith($sha) } | Select-Object -First 1
        
        if ($matchingTag) {
            return $matchingTag.name
        }
        
        
        return "unknown-version"
    }
    catch {
        Write-Warning "Could not determine version for $owner/$repo@$sha"
        return "unknown-version"
    }
}

# Get all workflow files
$workflowFiles = Get-ChildItem -Path ".github/workflows" -Filter "*.yml" -Recurse

foreach ($file in $workflowFiles) {
    $content = Get-Content $file.FullName
    $modified = $false
    
    # Regular expression to match GitHub Action uses statements with SHA
    $regex = 'uses:\s+([\w-]+)/([\w-]+)@([0-9a-f]{40}|[0-9a-f]{7})'
    
    for ($i = 0; $i -lt $content.Count; $i++) {
        $line = $content[$i]
        $match = [regex]::Match($line, $regex)
        
        if ($match.Success) {
            $owner = $match.Groups[1].Value
            $repo = $match.Groups[2].Value
            $sha = $match.Groups[3].Value
            
            Write-Host "Found action: $owner/$repo@$sha"
            
            $version = Get-ActionVersion -owner $owner -repo $repo -sha $sha
            
            # Check if line already has a version comment
            if ($line -notmatch '#\s*v\d') {
                $content[$i] = "$line #$version"
                $modified = $true
            }
        }
    }
    
    if ($modified) {
        Write-Host "Writing changes to $($file.FullName)"
        $content | Set-Content $file.FullName
    }
}

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.