[2.11] Pin GitHub Actions to commit SHAs

[ruanyl]

Description

Pin third-party GitHub Action references in release-branch workflows to full-length commit SHAs to satisfy the repository action policy.

OpenSearch-managed reusable workflows are intentionally left unchanged.

Verification

• Scanned .github/workflows for non-opensearch-project uses: refs not pinned to 40-character SHAs
• Ran git diff --check
• Parsed changed workflow YAML files

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 9242dd2.

Path	Line	Severity	Description
.github/workflows/backport.yml	18	high	GitHub Action dependency change: tibdex/github-app-token version pinned to commit SHA. This action handles GitHub App private keys and token generation — maintainers must verify the SHA resolves to the expected v1.5.0 release commit.
.github/workflows/backport.yml	28	high	GitHub Action dependency change: VachaShah/backport version pinned to commit SHA. Third-party action with write access to branches; maintainers must verify SHA authenticity.
.github/workflows/delete_backport_branch.yml	15	high	GitHub Action dependency change: SvanBoxel/delete-merged-branch previously pinned to mutable @main tag, now pinned to commit SHA. The prior @main reference was especially risky; maintainers must verify the new SHA is the intended commit.
.github/workflows/cypress-workflow-vanilla-snapshot-based.yml	71	high	GitHub Action dependency change: cypress-io/github-action version pinned to commit SHA. Third-party action that executes test commands with full runner access; maintainers must verify SHA matches expected v2 release.
.github/workflows/alerting-release-e2e-workflow.yml	11	high	GitHub Action dependency change: dorny/paths-filter version pinned to commit SHA across multiple workflow files. Maintainers must verify SHA 4512585405083f25c027a35db413c2b3b9006d50 corresponds to the expected v2 release.
.github/workflows/codeql-analysis.yml	41	high	GitHub Action dependency change: github/codeql-action/init, autobuild, and analyze all pinned to the same SHA. These actions run code analysis with broad repo access; maintainers must verify SHA 231aa2c8a89117b126725a0e11897209b7118144 is the legitimate v1 release.
.github/workflows/cypress-workflow-vanilla-snapshot-based.yml	22	high	GitHub Action dependency change: actions/checkout pinned to commit SHA ee0669bd1cc54295c223e0bb666b733df41de1c5. Used across many workflows; maintainers should verify this SHA against the official actions/checkout v2 tag.
.github/workflows/cypress-workflow-vanilla-snapshot-based.yml	19	high	GitHub Action dependency change: actions/setup-java pinned to commit SHA b6e674f4b717d7b0ae3baee0fbe79f498905dfde. Maintainers must verify this SHA corresponds to the expected v1 release.
.github/workflows/release-e2e-workflow-template.yml	103	high	GitHub Action dependency change: actions/cache pinned to commit SHA f5ce41475b483ad7581884324a6eca9f48f8dcc7. Maintainers must verify this SHA corresponds to the expected v1 release.
.github/workflows/release-e2e-workflow-template.yml	133	high	GitHub Action dependency change: actions/upload-artifact has two distinct SHA pins in this diff (3446296876d12d4e3a0f3145a3c87e67bf0a16b5 for v1, ea165f8d65b6e75b540449e92b4886f43607fa02 for v4). The differing SHAs across v1 and v4 pins are expected but both must be independently verified.

The table above displays the top 10 most important findings.

Total: 14 | Critical: 0 | High: 14 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.