[SINT-3848] 🔒 Pin GitHub Actions to specific SHA versions for enhanced security

[juliendoutre]

🔒 Security Enhancement: GitHub Actions Pinning

📋 What This PR Does

This PR automatically pins GitHub Actions references from tag-based versions (e.g., @v4) to their corresponding SHA hashes (e.g., @abc123...) while preserving the original tag as a comment for readability.
No functional changes to your workflows - they'll work exactly the same way

🎯 Why This Matters

Supply Chain Security: Pinning GitHub Actions to specific SHA hashes prevents supply chain security and reliability risks because git tags are mutable and can be moved to point to different commits by malicious actors or maintainers, potentially introducing vulnerabilities or breaking changes into workflows.

🤖 Keep Actions Updated with Dependabot

Now that your actions are pinned to SHA hashes, you can enable Dependabot to automatically create PRs when new versions are available. Add this configuration to your repository:

Create or update .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    commit-message:
      prefix: "chore"
      include: "scope"

This will:

• 🔄 Check for action updates weekly
• 📬 Create PRs automatically when newer versions are available
• 🏷️ Update both the SHA hash and the comment with the new tag
• 🎯 Keep your actions secure AND up-to-date

🤝 Questions or Concerns?

For any questions about this security enhancement, please reach out to the SDL Security team in the #sdlc-security Slack channel.

---

This PR was automatically generated by the GitHub Actions Pinning Tool as part of our ongoing security improvements.

[eliottness]

Is there a way to put repositories like DataDog/dd-trace-go in a whitelist ?

[eliottness]

This is used for cross-validation between repositories we own and trust. Pinning it make it lose it's meaning for us and for the nightly

[juliendoutre]

Got you, I will edit the PR to remove this specific hash from the changes. Thanks for flagging!

[juliendoutre]

/merge

[dd-devflow-routing-codex]

View all feedbacks in Devflow UI.

2025-08-18 13:25:41 UTC ℹ️ Start processing command /merge

---

2025-08-18 13:25:57 UTC ℹ️ MergeQueue: waiting for PR to be ready

This merge request is not mergeable yet, because of pending checks/missing approvals. It will be added to the queue as soon as checks pass and/or get approvals.
Note: if you pushed new commits since the last approval, you may need additional approval.
You can remove it from the waiting list with /remove command.

---

2025-08-18 17:26:11 UTC ⚠️ MergeQueue: This merge request was unqueued

devflow unqueued this merge request: It did not become mergeable within the expected time