CI : Pin github actions to full commit sha

[Aniketsy]

• closes CI : Pin github actions to full commit SHA #9799
• tests added / passed.
• code/documentation is well formatted.
• properly formatted commit message. See
  NumPy's guide.

Details

Notes:

• It is essential that you add a test when making code changes. Tests are not
  needed for doc changes.
• When adding a new function, test values should usually be verified in another package (e.g., R/SAS/Stata).
• When fixing a bug, you must add a test that would produce the bug in main and
  then show that it is fixed with the new code.
• New code additions must be well formatted. Changes should pass flake8. If on Linux or OSX, you can
  verify you changes are well formatted by running

  git diff upstream/main -u -- "*.py" | flake8 --diff --isolated
  

  assuming flake8 is installed. This command is also available on Windows
  using the Windows System for Linux once flake8 is installed in the
  local Linux environment. While passing this test is not required, it is good practice and it help
  improve code quality in statsmodels.
• Docstring additions must render correctly, including escapes and LaTeX.

[bashtage]

Does this interfere with autoupdating dependencies?

[Aniketsy]

Does this interfere with autoupdating dependencies?

No, it will not

[bashtage]

@copilot please fix the merge conflicts in this pull request.

[bashtage]

@copilot please fix the merge conflicts in this pull request.

[Copilot]

Pull request overview

This PR hardens the GitHub Actions CI configuration by replacing mutable action version tags with full commit SHAs, aligning with supply-chain security best practices (as requested in #9799).

Changes:

• Pin actions/checkout, actions/setup-python, github/codeql-action, pypa/cibuildwheel, r-lib/actions/setup-pandoc, and ts-graphviz/setup-graphviz to full 40-character commit SHAs.
• Apply the pinning consistently across all existing workflows (documentation build, wheels cron job, emscripten/pyodide build, and CodeQL).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/generate-documentation.yml	Pins all third-party actions used in documentation generation to full commit SHAs.
.github/workflows/emscripten.yml	Pins checkout and cibuildwheel actions to full commit SHAs for the Pyodide build workflow.
.github/workflows/cron-test.yml	Pins checkout, setup-python, and cibuildwheel actions to full commit SHAs for scheduled wheel builds.
.github/workflows/codeql.yml	Pins checkout and all CodeQL action steps (init/autobuild/analyze) to a full commit SHA.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Aniketsy]

@bashtage i've fixed the conflict in this

[Aniketsy]

After moving with this, i'd like to know thoughts on zizmor

As a follow up we can implement Zizmor in our workflow https://github.com/zizmorcore/zizmor

[bashtage]

Thanks. Copilot could fix the conflict. So much for AI taking over :-)

All complete.