Pin third-party GitHub Actions to commit SHAs

[mahangu]

Pins GitHub Actions in this repo to immutable commit SHAs.

This PR was prepared with agent assistance and manually verified.

Tracking: DEVPROD-1072

Why

Tag references like actions/checkout@v6 are mutable — a tag can be moved to point at different code after review. Pinning each action to a full 40-character commit SHA (with a trailing # vX.Y.Z comment for readability) makes the supply chain immutable and auditable. Grouped Dependabot updates keep the pins current.

Verification

For each pinned action below, the gh api call returns the commit SHA the tag currently points to; it must match the SHA in the workflow file.

# Confirm each pinned action's SHA matches its trailing version comment, e.g.:
#   gh api repos/<owner>/<repo>/commits/<vX.Y.Z> --jq .sha
# (one call per pinned action; the SHA must match the workflow file)

Re-scan the repo for any remaining unpinned references in scope (should print nothing):

grep -rn 'uses:' .github | grep -v '@[0-9a-f]\{40\}'

[Copilot]

Pull request overview

Pins a third-party GitHub Action reference to an immutable commit SHA to improve workflow supply-chain integrity (DEVPROD-1072).

Changes:

• Pin php-actions/composer in the unit test workflow to a specific commit SHA (with a version comment).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.