Pin backport actions to SHAs

[rainersigwald]

This can be required by repo configuration and is considered a GitHub Actions security best practice.

I turned the setting on in dotnet/msbuild and got errors like https://github.com/dotnet/msbuild/actions/runs/27234807068.

To double check:

• The right tests are in and the right validation has happened. Guidance: https://github.com/dotnet/arcade/blob/main/Documentation/Validation.md

[Copilot]

Pull request overview

Updates the shared backport workflow to follow GitHub Actions security guidance by pinning third-party actions to immutable commit SHAs, improving supply-chain integrity for repos that consume this workflow.

Changes:

• Pin actions/github-script usages to a specific commit SHA (annotated as v9.0.0).
• Pin actions/checkout usage to a specific commit SHA (annotated as v6.0.3).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[JanProvaznik]

/backport to release/10.0

[github-actions]

Started backporting to release/10.0 (link to workflow run)

[github-actions]

@JanProvaznik backporting to release/10.0 failed, the patch most likely resulted in conflicts. Please backport manually!

git am output

$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: Pin backport actions to SHAs
Using index info to reconstruct a base tree...
M	.github/workflows/backport-base.yml
Falling back to patching base and 3-way merge...
Auto-merging .github/workflows/backport-base.yml
CONFLICT (content): Merge conflict in .github/workflows/backport-base.yml
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Pin backport actions to SHAs
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output