Keep the pinact check passing on pinact v4

- Add the version comments v4 now requires on every SHA pin in
  zz-test-worker-poc.yaml.
- Correct the slapr comment to 1.0.0, the tag that SHA actually carries.
- Exempt dtolnay/rust-toolchain and DataDog/commit-headless, neither of which
  can carry a comment pinact accepts.
- Set fix: false, since as of pinact-action v3 skip_push alone rewrites the
  files instead of validating them.

Author: AAraKKe

.github/pinact.yml

@@ -2,3 +2,17 @@
 # GitHub actions are left unpined: .github/workflows/validate-pinned-actions.yml
 # Used to exclude specific actions from the pin check
 version: 3
+
+# pinact requires a version comment next to every SHA pin. These two actions
+# cannot satisfy that check, so they are exempt from it.
+rules:
+  # Only publishes the `v1` tag; every other ref is a branch, so the pin tracks
+  # a `master` commit and there is no version to name.
+  - ignore: true
+    conditions:
+      - expr: ActionRepoFullName == "dtolnay/rust-toolchain"
+  # Tagged as `action/v2.0.3`, and pinact does not recognise prefixed tags as
+  # version comments.
+  - ignore: true
+    conditions:
+      - expr: ActionRepoFullName == "DataDog/commit-headless"

.github/workflows/slapr.yml

@@ -16,7 +16,7 @@ jobs:
           - SLACK_CHANNEL_ID
           - SLACK_CHANNEL_ID_AGENT_INTEGRATIONS_REVIEWS
     steps:
-    - uses: DataDog/slapr@4b5efe2ce585e45898bb88c4fa303e226e8199e4 # Not versioned, latest commit in master as of 2025-05-08
+    - uses: DataDog/slapr@4b5efe2ce585e45898bb88c4fa303e226e8199e4 # 1.0.0
       env:
         GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         SLACK_CHANNEL_ID: "${{ secrets[matrix.slack_channel_variable] }}"

.github/workflows/validate-pinned-actions.yml

@@ -27,6 +27,9 @@ jobs:
         # tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
         uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
         with:
+          # As of v3, skip_push alone fixes the files in the workspace instead of
+          # validating them. fix: false keeps this job a read-only check.
+          fix: false
           skip_push: true
 
       - name: Output pin actions failure message

.github/workflows/zz-test-worker-poc.yaml

@@ -29,7 +29,7 @@ jobs:
       check_run_id: ${{ steps.create_check.outputs.result }}
     steps:
       - name: Get GitHub token via dd-octo-sts
-        uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80
+        uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
         id: octo-sts
         with:
           scope: DataDog/integrations-core
@@ -63,12 +63,12 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.checkout_ref }}
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.13'
 
@@ -97,7 +97,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.checkout_ref }}
 
@@ -118,7 +118,7 @@ jobs:
       contents: read
     steps:
       - name: Get GitHub token via dd-octo-sts
-        uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80
+        uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
         id: octo-sts
         with:
           scope: DataDog/integrations-core