Refactor hardcoded actions/github-script SHA to dynamic resolution

[Copilot]

The generateGitHubMCPLockdownDetectionStep function used a hardcoded SHA for actions/github-script@v7.0.1, preventing automatic updates when newer versions are available in action_pins.json.

Changes

• Replace hardcoded SHA with GetActionPinWithData() call using constants.DefaultGitHubScriptVersion
• Add error handling with fallback to version tag for resolution failures
• Now resolves to v8.0.0 (SHA: ed597411d8f924073f98dfc5c65a23a2325f34cd)

Before:

yaml.WriteString("        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1\n")

After:

actionRepo := "actions/github-script"
actionVersion := string(constants.DefaultGitHubScriptVersion)
pinnedAction, err := GetActionPinWithData(actionRepo, actionVersion, data)
if err != nil {
    pinnedAction = fmt.Sprintf("%s@%s", actionRepo, actionVersion)
}
yaml.WriteString(fmt.Sprintf("        uses: %s\n", pinnedAction))

Lock files automatically regenerated with updated SHA. Future version updates in action_pins.json will propagate automatically.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login ithub-script/git/ref/tags/v8 infocmp e/git d-artifact.git d-artifact.git /usr/bin/infocmp-v e/git api /ref/tags/v8 --jq (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Refactor calls to actions/github-script in the .go compiler to resolve the latest version. For example,

	yaml.WriteString("        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1\n")

should first resolve the latest tag of actions/github-script then inlined the resolved sha

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.