BAU: Ensure that actions are pinned to SHAs

[whi-tw]

What problem does this pull request solve?

This will flag that non-sha-pinned actions are present in workflows. SHA-pinning is advised in GDS-way.

[Copilot]

Pull Request Overview

This PR adds a new workflow to enforce SHA-pinned GitHub Actions across all workflow files, aligning with GDS security standards that recommend pinning actions to specific commit SHAs rather than tags.

Key Changes:

• New workflow triggers on PR events when workflow files are modified
• Uses a third-party action to validate that all GitHub Actions are pinned to commit SHAs

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[github-actions]

💰 Infracost report

This pull request is aligned with your company's FinOps policies and the Well-Architected Framework.

Monthly estimate generated

Estimate details (includes details of unsupported resources and skipped projects due to errors)

──────────────────────────────────
Project: forms-health-dev
Module path: infra/deployments/forms/health
Errors:
 Error loading Terraform modules:
  could not load modules for path /home/runner/work/forms-deploy/forms-deploy/infra/deployments/forms/health failed to parse file /home/runner/work/forms-deploy/forms-deploy/infra/deployments/forms/health/alerts/variables.tf diag:
   /home/runner/work/forms-deploy/forms-deploy/infra/deployments/forms/health/alerts/variables.tf:32,90-91:
    Missing argument separator; A comma is required to separate each function argument from the next., and 1 other diagnostic(s)

──────────────────────────────────
Project: forms-health-production
Module path: infra/deployments/forms/health
Errors:
 Error loading Terraform modules:
  could not load modules for path /home/runner/work/forms-deploy/forms-deploy/infra/deployments/forms/health failed to parse file /home/runner/work/forms-deploy/forms-deploy/infra/deployments/forms/health/alerts/variables.tf diag:
   /home/runner/work/forms-deploy/forms-deploy/infra/deployments/forms/health/alerts/variables.tf:32,90-91:
    Missing argument separator; A comma is required to separate each function argument from the next., and 1 other diagnostic(s)

──────────────────────────────────
Project: forms-health-staging
Module path: infra/deployments/forms/health
Errors:
 Error loading Terraform modules:
  could not load modules for path /home/runner/work/forms-deploy/forms-deploy/infra/deployments/forms/health failed to parse file /home/runner/work/forms-deploy/forms-deploy/infra/deployments/forms/health/alerts/variables.tf diag:
   /home/runner/work/forms-deploy/forms-deploy/infra/deployments/forms/health/alerts/variables.tf:32,90-91:
    Missing argument separator; A comma is required to separate each function argument from the next., and 1 other diagnostic(s)

──────────────────────────────────
Project: forms-health-user-research
Module path: infra/deployments/forms/health
Errors:
 Error loading Terraform modules:
  could not load modules for path /home/runner/work/forms-deploy/forms-deploy/infra/deployments/forms/health failed to parse file /home/runner/work/forms-deploy/forms-deploy/infra/deployments/forms/health/alerts/variables.tf diag:
   /home/runner/work/forms-deploy/forms-deploy/infra/deployments/forms/health/alerts/variables.tf:32,90-91:
    Missing argument separator; A comma is required to separate each function argument from the next., and 1 other diagnostic(s)

──────────────────────────────────
──────────────────────────────────
57 projects have no cost estimate changes.
Run the following command to see their breakdown: infracost breakdown --path=/path/to/code

──────────────────────────────────
3790 cloud resources were detected:
∙ 739 were estimated
∙ 3021 were free
∙ 30 are not supported yet, see https://infracost.io/requested-resources:
  ∙ 26 x aws_codepipeline
  ∙ 4 x aws_guardduty_malware_protection_plan

---

_{This comment will be updated when code changes.}

[cadmiumcat]

Thankles

[github-actions]

Warning

You are changing the Terraform version.

Before you merge this PR, you must apply the forms/pipelines
Terraform root from this branch in each of the forms environments.

make ENV forms/pipelines apply