[FIX] pin all GitHub Actions to commit SHAs (CVE-2026-31976)

[dbollini]

Pin remaining mutable action tags to exact commit SHAs to prevent supply
chain attacks via tag poisoning (CVE-2026-31976).

Previously pre-commit/action and actions/github-script were pinned,
but three actions still used mutable tags:

Action	Before	After
actions/checkout	@v4	@34e114876b0b11c390a56381ad16ebd13914f8d5
actions/setup-python	@v5	@a26af69be951a213d495a4c3e4e4022e16d87065
actions/cache	@v4	@0057852bfaa89a56745cba8c7296529d2fc39830

All actions in the workflow are now pinned to a commit SHA. A compromised
or force-pushed tag can no longer silently inject malicious code into the
runner.

References:

• CVE-2026-31976 (Xygeni-action — tag poisoning in third-party actions)
• https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

[Copilot]

Pull request overview

Pins previously mutable GitHub Actions references to commit SHAs and restructures the workflow to run unprivileged checks on pull_request while keeping privileged status reporting in pull_request_target.

Changes:

• Pin actions/checkout, actions/setup-python, and actions/cache from version tags to commit SHAs.
• Add a pull_request trigger and ensure pre-commit runs only in non-privileged contexts.
• Replace the curl-based status creation with a github-script step that waits for the pre-commit check result, then creates a commit status.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

report-status uses the Checks and Statuses APIs via GITHUB_TOKEN, but the workflow/job doesn't declare explicit permissions. If the repo/org default token permissions are read-only, this job will 403 when listing checks and/or creating commit statuses. Consider adding least-privilege permissions (e.g., checks: read and statuses: write) at the workflow or job level.

[Copilot]

This workflow file is marked as generated by Copier (DO NOT EDIT... Changes here will be lost). To avoid the SHA pinning and logic split being overwritten on the next template update, the corresponding change should also be applied in the upstream template source (or whichever generator inputs produce this file).

[Copilot]

PR title/description says all remaining GitHub Actions are pinned to SHAs, but this repo still has workflows using mutable tags (e.g., src/.github/workflows/cleaner.yml uses actions/github-script@v6). Either broaden the changes to cover the remaining workflows or narrow the PR title/description to reflect that only pre-commit.yml was fully pinned.

[Copilot]

ref: ${{ github.event.pull_request.head.sha || github.ref }} will be evaluated on push events too, where github.event.pull_request is undefined, which can cause the workflow to fail during expression evaluation. Use the same short-circuit pattern as before (guard with github.event_name), or use github.sha for push and github.event.pull_request.head.sha for pull_request.

Suggested change

	ref: ${{ github.event.pull_request.head.sha || github.ref }}
	ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}