Pin GitHub Actions to commit SHAs in CI/CD workflow for security compliance

[Copilot]

This PR updates the CI/CD workflow file (.github/workflows/ci-cd.yml) to pin GitHub Actions to specific full-length commit SHAs as per the repository security policy.

Changes Made

Updated all instances of GitHub Actions in the CI/CD pipeline from version tags to pinned commit SHAs:

• actions/checkout@v3 → actions/checkout@5e2a0b03c4b5edb8c0b96e2cc127b8b9c7a36a5c
• actions/setup-node@v3 → actions/setup-node@f5f7a6b5d3c5edb8c2d96e2cc127b8c9d3b25a5e

Security Benefits

Pinning actions to commit SHAs provides:

• Immutable references: Prevents supply chain attacks where action versions could be modified
• Reproducible builds: Ensures the exact same action code runs every time
• Compliance: Meets repository security policy requirements for action pinning

Affected Jobs

The following workflow jobs were updated:

• build: Build Contracts job
• test: Run Tests job
• deploy: Deploy Contracts job

All jobs now use the pinned commit SHAs for both checkout and Node.js setup actions.

Validation

• ✅ YAML syntax validated
• ✅ All 6 action references updated correctly
• ✅ Workflow structure and functionality preserved

This pull request was created as a result of the following prompt from Copilot chat.

Update the workflow file .github/workflows/ci-cd.yml to pin the actions/checkout and actions/setup-node actions to the following full-length commit SHAs, as per repository security policy:

• Use actions/checkout@5e2a0b0 for code checkout.
• Use actions/setup-node@f5f7a6b for Node.js setup.

Example YAML snippet:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@5e2a0b03c4b5edb8c0b96e2cc127b8b9c7a36a5c

      - name: Set up Node.js
        uses: actions/setup-node@f5f7a6b5d3c5edb8c2d96e2cc127b8c9d3b25a5e
        with:
          node-version: 16

Replace any previous references to actions/checkout and actions/setup-node (using version tags or other SHAs) with the above full-length SHAs. Commit and push the changes to the default branch.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[sonnyquinn24]

@copilot

[Copilot]

Copilot wasn't able to review any files in this pull request.

[sonnyquinn24]

@copilot

[sonnyquinn24]

Todo

[sonnyquinn24]

To do