[2.13] Pin GitHub Actions to commit SHAs

[ruanyl]

Description

Pin third-party GitHub Action references in release-branch workflows to full-length commit SHAs to satisfy the repository action policy.

OpenSearch-managed reusable workflows are intentionally left unchanged.

Verification

• Scanned .github/workflows for non-opensearch-project uses: refs not pinned to 40-character SHAs
• Ran git diff --check
• Parsed changed workflow YAML files

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 1a3fa2e.

Path	Line	Severity	Description
.github/workflows/alerting-release-e2e-workflow.yml	11	high	GitHub Action dependency changed: dorny/paths-filter@v2 pinned to commit SHA 4512585405083f25c027a35db413c2b3b9006d50. Per mandatory rule, all action version changes must be flagged for maintainer verification regardless of apparent intent.
.github/workflows/auto-release.yml	16	high	GitHub Action dependency changed: tibdex/github-app-token@v1.5.0 pinned to commit SHA 1901dc7d52169e70c27a8da37aef0d423e2867a2. This action handles sensitive APP_ID and APP_PRIVATE_KEY secrets; SHA authenticity must be verified.
.github/workflows/auto-release.yml	19	high	GitHub Action dependency changed: ncipollo/release-action@v1 pinned to commit SHA 339a81892b84b4eeb0f6e744e4574d79d0d9b8dd. Third-party release action change requires maintainer verification.
.github/workflows/backport.yml	28	high	GitHub Action dependency changed: VachaShah/backport@v1.1.4 pinned to commit SHA 28c49d91ceec57d7c9f625f1031c1a4d637251f5. Third-party fork action with write access to branches; SHA authenticity must be verified.
.github/workflows/delete_backport_branch.yml	15	high	GitHub Action dependency changed: SvanBoxel/delete-merged-branch@main pinned to commit SHA 2b5b058e3db41a3328fd9a6a58fd4c2545a14353. Previously used floating @main ref; now pinned. Maintainers should verify the commit corresponds to the expected state of the action.
.github/workflows/codeql-analysis.yml	41	high	GitHub Action dependency changed: github/codeql-action/init@v1 pinned to commit SHA 231aa2c8a89117b126725a0e11897209b7118144. Same SHA reused for init, autobuild, and analyze sub-actions; verify SHA maps to official github/codeql-action v1.
.github/workflows/release-e2e-workflow-template.yml	32	high	GitHub Action dependency changed: actions/setup-java@v1 pinned to commit SHA b6e674f4b717d7b0ae3baee0fbe79f498905dfde. Verify SHA corresponds to the official actions/setup-java v1 release.
.github/workflows/release-e2e-workflow-template.yml	79	high	GitHub Action dependency changed: actions/setup-node@v1 pinned to commit SHA f1f314fca9dfce2769ece7d933488f076716723e. Verify SHA corresponds to the official actions/setup-node v1 release.
.github/workflows/release-e2e-workflow-template.yml	113	high	GitHub Action dependency changed: cypress-io/github-action@v2 pinned to commit SHA f5bea478b80a774068179089247f13d60abc5010. Third-party CI action with broad test execution privileges; SHA authenticity must be verified.
.github/workflows/release-e2e-workflow-template.yml	107	high	GitHub Action dependency changed: actions/cache@v1 pinned to commit SHA f5ce41475b483ad7581884324a6eca9f48f8dcc7. Verify SHA corresponds to the official actions/cache v1 release.

The table above displays the top 10 most important findings.

Total: 14 | Critical: 0 | High: 14 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.