ci: update workflows on release/25.10-lts

[fluentdo-ci]

Update workflows automatically on release/25.10-lts

• Created by https://github.com/telemetryforge/agent/actions/runs/23061430742
• Auto-generated by create-pull-request: https://github.com/peter-evans/create-pull-request

[cubic-dev-ai]

No issues found across 19 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

[Copilot]

Pull request overview

This PR hardens CI on release/25.10-lts by pinning GitHub Actions uses: references to immutable commit SHAs for better security and reproducibility, and adds automated enforcement for future PRs.

Changes:

• Pin GitHub Actions across CI workflows to specific commit SHAs (with version comments in most places).
• Add a PR check (“Actions Pin SHA”) using suzuki-shunsuke/pinact-action to enforce SHA pinning.
• Update Dependabot configuration to group github-actions and docker updates, and pin the frabert/replace-string-action used by the get-package-name composite action.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/update-version.yaml	Pins workflow dependencies (checkout, GCP auth/secrets, create-pull-request) to SHAs.
.github/workflows/update-lts-branches.yaml	Pins workflow dependencies for LTS branch update automation to SHAs.
.github/workflows/unit-tests.yaml	Pins actions used for unit tests, coverage upload, and job aggregation.
.github/workflows/test.yaml	Pins checkout action in test workflow.
.github/workflows/pr-comment-build.yaml	Pins debug/github-script/checkout actions used for PR comment-driven builds.
.github/workflows/lint.yaml	Pins lint actions and adds an Actions SHA pinning enforcement job.
.github/workflows/lint-packages.yaml	Pins checkout and download-artifact for package linting.
.github/workflows/cron-auto-release.yaml	Pins actions used in scheduled auto-release workflow (checkout, GCP auth/secrets).
.github/workflows/call-test-packages.yaml	Pins docker/setup and artifact actions; updates BATS action usage.
.github/workflows/call-test-containers.yaml	Pins checkout/docker/login/BATS/tools/actions used in container tests.
.github/workflows/call-test-containers-k8s.yaml	Pins checkout/docker/login/helm/kubectl/kind/BATS actions used in k8s tests.
.github/workflows/call-publish-release-images.yaml	Pins docker/login, openshift tools installer, and GCP auth/secrets actions.
.github/workflows/call-build-windows-packages.yaml	Pins checkout/MSVC/chocolatey/cache/artifact actions for Windows packaging.
.github/workflows/call-build-macos-packages.yaml	Pins checkout/cmake/artifact actions for macOS packaging.
.github/workflows/call-build-linux-packages.yaml	Pins checkout/docker/setup/login/artifact actions for Linux packaging.
.github/workflows/call-build-containers.yaml	Pins docker build/push/metadata/setup and cosign installer actions.
.github/workflows/build.yaml	Pins actions across build+release pipeline and reusable workflow invocation.
.github/dependabot.yml	Adds grouping for github-actions/docker updates (but see review comment re indentation).
.github/actions/get-package-name/action.yml	Pins frabert/replace-string-action to a specific commit SHA.

Comments suppressed due to low confidence (1)

.github/workflows/lint.yaml:45

• The actionlint step downloads and executes a script from rhysd/actionlint's main branch via curl, which is not pinned and undermines the supply-chain hardening this PR is introducing. Prefer installing actionlint from a pinned release artifact/checksum or using a dedicated action pinned to a commit SHA.

      - run: |
          echo "::add-matcher::.github/actionlint-matcher.json"
          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
          ./actionlint -color -shellcheck=

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.