workflows: pin Homebrew/actions to 2026.07.10.1

[p-linnane]

Pin Homebrew/actions references to the immutable 2026.07.10.1 release using its full commit SHA and version comment.

This removes mutable @main dependencies while allowing Dependabot to track future releases.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• AI was used to generate or assist with generating this PR.

AI assisted with the mechanical pin updates. The changes were verified with actionlint, git diff --check, a focused style check for tap-new.rb, and a zizmor scan confirming no pin/comment mismatches.

---

[github-actions]

Thanks for your pull request. This has been closed because it appears to use an incomplete or outdated pull request template.

Please edit this pull request to fill in the current pull request template. This workflow will reopen this pull request automatically once the template is complete. Do not open a new pull request for this.

[Copilot]

Pull request overview

Pins Homebrew/actions usages in this repo’s GitHub workflows (and the tap-new workflow template) from the mutable @main ref to the immutable 2026.07.10.1 release commit (1f8e202ffddf94def7f42f6fa3a482e821489f9c), using the full SHA plus an inline version comment. This aligns workflow security/reproducibility with a “no floating refs” approach while keeping Dependabot-friendly version annotations.

Changes:

• Replace Homebrew/actions/*@main with Homebrew/actions/*@1f8e202ffddf94def7f42f6fa3a482e821489f9c # 2026.07.10.1 across multiple workflows.
• Update the brew tap-new generated workflow template to emit pinned Homebrew/actions references.
• Keep pins consistent across all touched files (same SHA/comment for each Homebrew/actions action).

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
Library/Homebrew/dev-cmd/tap-new.rb	Updates the generated workflow template to pin Homebrew/actions to the 2026.07.10.1 SHA.
.github/workflows/vendor-version.yml	Pins setup-homebrew action reference to the release SHA.
.github/workflows/vendor-gems.yml	Pins multiple Homebrew/actions steps (setup, git config, signing, caching, push).
.github/workflows/tests.yml	Pins setup-homebrew and cache-homebrew-prefix usages throughout CI jobs.
.github/workflows/sync-default-branches.yml	Pins git-user-config usage.
.github/workflows/sponsors-maintainers-man-completions.yml	Pins setup/git/signing/push/issue actions to the release SHA.
.github/workflows/spdx.yml	Pins setup/git/signing/push/issue actions to the release SHA.
.github/workflows/sorbet.yml	Pins setup/git/signing/push/issue actions to the release SHA.
.github/workflows/sbom.yml	Pins setup/git/signing/push/issue actions to the release SHA.
.github/workflows/release.yml	Pins setup and prefix-cache actions to the release SHA.
.github/workflows/doctor.yml	Pins setup action references to the release SHA.
.github/workflows/docs.yml	Pins setup, setup-ruby, and issue actions to the release SHA.
.github/workflows/copilot-setup-steps.yml	Pins setup and prefix-cache actions used by Copilot setup steps workflow.
.github/workflows/autogenerated-files.yml	Pins setup action reference to the release SHA.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.