chore(actions): pin workflow actions to commits

[2heal1]

Description

Pins GitHub Actions workflow dependencies to fixed commit hashes instead of mutable tags.

This covers the current workflow Action usage and keeps the original tag as an inline comment for future upgrades. The two mobile runner actions were already pinned and were left as-is.

This branch also includes the actions-cool/issues-helper removal because that repository is disabled by GitHub and cannot be safely pinned. The issue automation is replaced with GitHub CLI commands and limited issue permissions.

Related Issue

Security hardening after the actions-cool/issues-helper incident and to reduce tag-move supply chain risk.

Types of changes

• Docs change / refactoring / dependency upgrade
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Checklist

• I have added tests to cover my changes.
• All new and existing tests passed.
• I have updated the documentation.

Validation run locally:

• Scanned workflow uses: entries: total_uses=99, unpinned=0
• Confirmed no actions-cool/issues-helper references remain
• pnpm exec prettier --check .github/workflows
• YAML parse check for every workflow file
• git diff --check -- .github/workflows
• pnpm run ci:local --only=actionlint confirms this repo treats actionlint as GitHub-only and skips it locally

Skipped full package build/tests because this only changes GitHub workflow Action references and issue automation.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1732b10

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[netlify]

✅ Deploy Preview for module-federation-docs ready!

Name	Link
🔨 Latest commit	1732b10
🔍 Latest deploy log	https://app.netlify.com/projects/module-federation-docs/deploys/6a0c143092dfd60008869af3
😎 Deploy Preview	https://deploy-preview-4741--module-federation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[pkg-pr-new]

Open in StackBlitz

@module-federation/devtools

pnpm add https://pkg.pr.new/@module-federation/devtools@1732b10

@module-federation/cli

pnpm add https://pkg.pr.new/@module-federation/cli@1732b10

create-module-federation

pnpm add https://pkg.pr.new/create-module-federation@1732b10

@module-federation/dts-plugin

pnpm add https://pkg.pr.new/@module-federation/dts-plugin@1732b10

@module-federation/enhanced

pnpm add https://pkg.pr.new/@module-federation/enhanced@1732b10

@module-federation/error-codes

pnpm add https://pkg.pr.new/@module-federation/error-codes@1732b10

@module-federation/esbuild

pnpm add https://pkg.pr.new/@module-federation/esbuild@1732b10

@module-federation/managers

pnpm add https://pkg.pr.new/@module-federation/managers@1732b10

@module-federation/manifest

pnpm add https://pkg.pr.new/@module-federation/manifest@1732b10

@module-federation/metro

pnpm add https://pkg.pr.new/@module-federation/metro@1732b10

@module-federation/metro-plugin-rnc-cli

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnc-cli@1732b10

@module-federation/metro-plugin-rnef

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnef@1732b10

@module-federation/metro-plugin-rock

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rock@1732b10

@module-federation/modern-js

pnpm add https://pkg.pr.new/@module-federation/modern-js@1732b10

@module-federation/modern-js-v3

pnpm add https://pkg.pr.new/@module-federation/modern-js-v3@1732b10

@module-federation/native-federation-tests

pnpm add https://pkg.pr.new/@module-federation/native-federation-tests@1732b10

@module-federation/native-federation-typescript

pnpm add https://pkg.pr.new/@module-federation/native-federation-typescript@1732b10

@module-federation/nextjs-mf

pnpm add https://pkg.pr.new/@module-federation/nextjs-mf@1732b10

@module-federation/node

pnpm add https://pkg.pr.new/@module-federation/node@1732b10

@module-federation/retry-plugin

pnpm add https://pkg.pr.new/@module-federation/retry-plugin@1732b10

@module-federation/rsbuild-plugin

pnpm add https://pkg.pr.new/@module-federation/rsbuild-plugin@1732b10

@module-federation/rspack

pnpm add https://pkg.pr.new/@module-federation/rspack@1732b10

@module-federation/rspress-plugin

pnpm add https://pkg.pr.new/@module-federation/rspress-plugin@1732b10

@module-federation/runtime

pnpm add https://pkg.pr.new/@module-federation/runtime@1732b10

@module-federation/runtime-core

pnpm add https://pkg.pr.new/@module-federation/runtime-core@1732b10

@module-federation/runtime-tools

pnpm add https://pkg.pr.new/@module-federation/runtime-tools@1732b10

@module-federation/sdk

pnpm add https://pkg.pr.new/@module-federation/sdk@1732b10

@module-federation/storybook-addon

pnpm add https://pkg.pr.new/@module-federation/storybook-addon@1732b10

@module-federation/third-party-dts-extractor

pnpm add https://pkg.pr.new/@module-federation/third-party-dts-extractor@1732b10

@module-federation/treeshake-frontend

pnpm add https://pkg.pr.new/@module-federation/treeshake-frontend@1732b10

@module-federation/treeshake-server

pnpm add https://pkg.pr.new/@module-federation/treeshake-server@1732b10

@module-federation/typescript

pnpm add https://pkg.pr.new/@module-federation/typescript@1732b10

@module-federation/utilities

pnpm add https://pkg.pr.new/@module-federation/utilities@1732b10

@module-federation/webpack-bundler-runtime

pnpm add https://pkg.pr.new/@module-federation/webpack-bundler-runtime@1732b10

@module-federation/bridge-react

pnpm add https://pkg.pr.new/@module-federation/bridge-react@1732b10

@module-federation/bridge-react-webpack-plugin

pnpm add https://pkg.pr.new/@module-federation/bridge-react-webpack-plugin@1732b10

@module-federation/bridge-shared

pnpm add https://pkg.pr.new/@module-federation/bridge-shared@1732b10

@module-federation/bridge-vue3

pnpm add https://pkg.pr.new/@module-federation/bridge-vue3@1732b10

@module-federation/inject-external-runtime-core-plugin

pnpm add https://pkg.pr.new/@module-federation/inject-external-runtime-core-plugin@1732b10

commit: 1732b10

[github-actions]

Bundle Size Report

10 package(s) changed, 30 unchanged.

Package dist + ESM entry

Package	Total dist (raw)	Delta	ESM gzip	Delta
@module-federation/cli	26.3 kB	no change	786 B	no change
@module-federation/core	39.1 kB	no change	173 B	no change
@module-federation/devtools	485.1 kB	no change	3.9 kB	no change
@module-federation/enhanced	807.3 kB	no change	672 B	no change
@module-federation/managers	69.8 kB	no change	334 B	no change
@module-federation/manifest	136.1 kB	no change	182 B	no change
@module-federation/metro-plugin-rnc-cli	0 B	no change	314 B	no change
@module-federation/node	193.4 kB	no change	217 B	no change
@module-federation/storybook-addon	77.7 kB	no change	100 B	no change
@module-federation/utilities	110.6 kB	no change	328 B	no change

Bundle targets

Package	Web bundle (gzip)	Delta	Node bundle (gzip)	Delta
@module-federation/cli	2.3 kB	-34 B (-1.4%)	2.3 kB	-34 B (-1.4%)
@module-federation/core	1.1 kB	-34 B (-3.0%)	1.0 kB	-32 B (-3.0%)
@module-federation/devtools	22.3 kB	-31 B (-0.1%)	22.3 kB	-31 B (-0.1%)
@module-federation/enhanced	2.6 kB	-46 B (-1.7%)	2.6 kB	-46 B (-1.7%)
@module-federation/managers	2.4 kB	-28 B (-1.1%)	2.4 kB	-28 B (-1.1%)
@module-federation/manifest	6.1 kB	-42 B (-0.7%)	6.1 kB	-42 B (-0.7%)
@module-federation/metro-plugin-rnc-cli	411 B	-27 B (-6.2%)	411 B	-27 B (-6.2%)
@module-federation/node	9.2 kB	-29 B (-0.3%)	9.2 kB	-29 B (-0.3%)
@module-federation/storybook-addon	1.9 kB	-25 B (-1.3%)	1.7 kB	-25 B (-1.4%)
@module-federation/utilities	2.6 kB	-33 B (-1.2%)	2.6 kB	-33 B (-1.2%)

Consumer scenarios

Scenario	Web output (gzip)	Delta	Node output (gzip)	Delta	Gap (node-web)	Delta
Enhanced remoteEntry	19.8 kB	-16 B (-0.1%)	20.8 kB	-8 B (-0.0%)	+1.0 kB	+8 B

Total dist (raw): 6.24 MB (no change)
Total ESM gzip: 74.1 kB (no change)
Total web bundle (gzip): 180.8 kB (-329 B (-0.2%))
Total node bundle (gzip): 181.2 kB (-327 B (-0.2%))
Tracked ./bundler entry gzip: 556 B (no change)
Tracked ./bundler web bundle (gzip): 4.8 kB (no change)
Tracked ./bundler node bundle (gzip): 4.8 kB (no change)

Bundle sizes are generated with rslib (Rspack). Package-root metrics preserve the historical report. Tracked subpath exports such as ./bundler are measured separately so ENV_TARGET-driven tree-shaking is visible. Bare imports are externalized to keep package-level sizes consistent, and assets are emitted as resources.