Pin GitHub Actions to commit SHAs

[Divyaasm]

Description

Pin all GitHub Action tag references to their corresponding commit SHAs.

Tags are mutable references that can be force-pushed to point to different commits, making them vulnerable to supply chain attacks. Commit SHAs are immutable and guarantee that the exact reviewed code is executed in CI workflows. This change pins all third-party actions to their current commit SHAs to prevent potential tampering.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit ebee17b.

Path	Line	Severity	Description
.github/workflows/maven-publish.yml	29	high	Dependency change: 1password/load-secrets-action pinned from @v2 to a specific commit SHA. This action handles secrets extraction; the SHA comment claims v2 but cannot be independently verified without checking the upstream repository.
.github/workflows/maven-publish.yml	38	high	Dependency change: aws-actions/configure-aws-credentials pinned from @v5 to a specific commit SHA. This action configures AWS credentials for deployment; SHA authenticity must be verified against the upstream repository.
.github/workflows/CI.yml	98	high	Dependency change: codecov/codecov-action pinned from @v5 to a specific commit SHA. This action uploads coverage reports using a token secret; SHA must be verified against the upstream repository.
.github/workflows/auto-release.yml	16	high	Dependency change: tibdex/github-app-token pinned from @v1.5.0 to a specific commit SHA. This third-party action handles GitHub App private keys and generates tokens; SHA must be verified.
.github/workflows/auto-release.yml	22	high	Dependency change: ncipollo/release-action pinned from @v1 to a specific commit SHA. This third-party action creates GitHub releases with a privileged token; SHA must be verified.
.github/workflows/backport.yml	23	high	Dependency change: VachaShah/backport pinned from @v1.1.4 to a specific commit SHA. This third-party action uses a GitHub token to create branches; SHA must be verified.
.github/workflows/links.yml	15	high	Dependency change: lycheeverse/lychee-action pinned from @master (a mutable branch reference) to a specific commit SHA. The previous reference to @master is particularly risky; SHA authenticity must be verified.
.github/workflows/create-documentation-issue.yml	35	high	Dependency change: peter-evans/create-issue-from-file pinned from @v4 to a specific commit SHA. This third-party action creates GitHub issues using a privileged token; SHA must be verified.
.github/workflows/auto-release.yml	21	high	Dependency change: dawidd6/action-get-tag pinned from @v1 to a specific commit SHA. This third-party action reads tag information in the release pipeline; SHA must be verified.
.github/workflows/draft-release-notes-workflow.yml	14	high	Dependency change: release-drafter/release-drafter pinned from @v5 to a specific commit SHA. This third-party action manages release notes with write permissions; SHA must be verified.

The table above displays the top 10 most important findings.

Total: 10 | Critical: 0 | High: 10 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.51%. Comparing base (11bd374) to head (ebee17b).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #3339      +/-   ##
============================================
- Coverage     83.58%   83.51%   -0.08%     
+ Complexity     4308     4303       -5     
============================================
  Files           451      451              
  Lines         15584    15584              
  Branches       2018     2018              
============================================
- Hits          13026    13015      -11     
- Misses         1770     1779       +9     
- Partials        788      790       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ Recommended focus areas for review Version Mismatch Line 23 pins actions/checkout to SHA de0fac2e4500dabe0009e67214ff5f5447ce83dd with comment # v6, but lines 62, 117, and 160 pin the same action to SHA 34e114876b0b11c390a56381ad16ebd13914f8d5 with comment # v4. If all instances should use v6 as stated in line 23, the other three are pinned to an outdated v4 SHA. This inconsistency means different jobs may run different action versions, potentially causing unexpected behavior or missing v6 features/fixes. - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 Outdated Action Lines 57, 143 pin actions/checkout to SHA 50fbc622fc4ef5163becd7fab6573eac35f8462e (v1) and lines 66, 152 pin actions/setup-java to SHA b6e674f4b717d7b0ae3baee0fbe79f498905dfde (v1). These are extremely old versions from 2019-2020. Using such outdated actions exposes the workflow to known bugs and security issues fixed in later releases. For example, v1 of checkout lacks modern features like submodule support improvements and security patches. uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1 # Setup git user so that patches for native libraries can be applied and committed - name: Setup git user run: | git config --global user.name "github-actions[bot]" git config --global user.email "github-actions[bot]@users.noreply.github.com" - name: Setup Java ${{ matrix.java }} uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde # v1