chore: pin GitHub Actions to commit SHAs

[tungvuson]

Why

N/A — automated security hardening (supply-chain security)

Summary

Pin all GitHub Actions uses: references to exact commit SHAs. Reusable workflow calls and local ./ refs are left unchanged.

Changes proposed in this pull request

• .github/**/*.yml / .github/**/*.yaml — each uses: action@tag replaced with uses: action@<commit-sha> # tag

Test Evidence

No logic changes. SHA values verified against GitHub API at time of generation.

Risk

Size: small diff (YAML comments only). Complexity: none. Type: CI config. Feature area: none. Requirements adherence: N/A. Test evidence clarity: N/A. Overall: no risk identified.

[Copilot]

Pull request overview

This PR hardens the repository’s GitHub Actions supply-chain security posture by replacing floating action tags/branches in workflow uses: directives with pinned commit SHAs (leaving local ./ references unchanged).

Changes:

• Pinned all third-party uses: references in .github/workflows/*.yml to exact commit SHAs while retaining the original tag/branch as an inline comment.
• Updated multiple workflows consistently to use the same pinned SHAs for shared actions (e.g., actions/checkout, ruby/setup-ruby).
• Normalized the previously-indented .github/workflows/add-untriaged.yml so it has correct top-level YAML structure while also pinning actions/github-script.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/test-unreleased.yml	Pins setup/checkout/cache/upload actions to SHAs for the unreleased integration workflow.
.github/workflows/release_drafter.yml	Pins checkout/manual-approval/setup-ruby/aws-credentials/gh-release actions to SHAs for the release drafting flow.
.github/workflows/main.yml	Pins checkout and setup-ruby actions to SHAs across the main integration test matrix jobs.
.github/workflows/lint.yml	Pins checkout and setup-ruby actions to SHAs for the RuboCop workflow.
.github/workflows/links.yml	Pins checkout and lychee link checker action to SHAs.
.github/workflows/license.yml	Pins checkout and setup-ruby actions to SHAs for the license header check.
.github/workflows/delete_backport_branch.yml	Pins delete-merged-branch action from @main to a specific commit SHA.
.github/workflows/compatibility.yml	Pins checkout and setup-ruby actions to SHAs for compatibility matrix workflows.
.github/workflows/change_log.yml	Pins checkout and changelog-enforcer actions to SHAs.
.github/workflows/backport.yml	Pins github-app-token and backport actions to SHAs for the backport automation.
.github/workflows/add-untriaged.yml	Pins github-script to a SHA and ensures the workflow YAML is properly top-level aligned.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.