ci: lock actions version

[pan93412]

Description (required)

pnpx actions-up --include-branches

Related issues & labels (optional)

• Closes PLA-1248
• Suggested label:

Summary by CodeRabbit

• Chores
  • Updated CI/CD workflow dependencies to use pinned commit versions for improved security and reproducibility across builds.

---

Note: This release contains infrastructure maintenance only. No user-facing features or functionality changes.

[coderabbitai]

Walkthrough

This PR updates GitHub Actions workflows to use pinned commit SHAs instead of floating version tags for checkout, setup-go, CodeQL actions, golangci-lint, goreleaser, and setup-node across four workflow files. No workflow logic or code changes were made.

Changes

Cohort / File(s)	Summary
GitHub Actions Pinning .github/workflows/build-test.yml, .github/workflows/codeql.yaml, .github/workflows/lint.yml, .github/workflows/release.yml	Replaced floating version tags (@v4, @v6, @v9) with pinned commit SHAs for actions/checkout, actions/setup-go, github/codeql-action, golangci/golangci-lint-action, goreleaser/goreleaser-action, and actions/setup-node to ensure consistent, reproducible workflow execution.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'ci: lock actions version' clearly and concisely summarizes the main change: pinning GitHub Actions to specific commit SHAs across multiple CI workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pan93412/pla-1248-ci-lock-actions-version-in-zeaburcli

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Pins GitHub Actions used in CI workflows to immutable commit SHAs to improve supply-chain security and build reproducibility.

Changes:

• Replace @v* action references with commit-SHA pins for actions/checkout, actions/setup-go, and actions/setup-node.
• Pin GoReleaser, golangci-lint, and CodeQL actions to commit SHAs across release/lint/code-scanning workflows.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/release.yml	Pins checkout/setup-go/goreleaser/setup-node actions to SHAs for deterministic releases.
.github/workflows/lint.yml	Pins checkout/setup-go/golangci-lint actions to SHAs for deterministic linting.
.github/workflows/codeql.yaml	Pins checkout/setup-go/codeql actions to SHAs for deterministic code scanning.
.github/workflows/build-test.yml	Pins checkout/setup-go actions to SHAs for deterministic build/test runs.

Comments suppressed due to low confidence (1)

.github/workflows/release.yml:40

• goreleaser/goreleaser-action is now pinned to a commit SHA, but the with.version: latest setting still pulls an unpinned GoReleaser binary at runtime. This makes releases non-reproducible and can unexpectedly change behavior. Consider pinning with.version to a specific GoReleaser version (or to a known good range) so the release workflow is fully deterministic.

      - uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c # v7.1.0
        with:
          distribution: goreleaser
          version: latest
          args: release --clean

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/release.yml (1)

22-46: Consider automating SHA updates.

While pinning to commit SHAs improves security, it requires manual updates for security patches and new features. Consider enabling Dependabot for GitHub Actions to automatically create PRs when new versions are released.

📝 Sample Dependabot configuration

Create or update .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    commit-message:
      prefix: "ci"
      include: "scope"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 22 - 46, The workflow pins GitHub
Actions to specific commit SHAs which requires manual updates; add Dependabot
configuration to auto-open PRs for github-actions updates and prefer version
tags or ranges instead of fixed commit SHAs where acceptable. Create or update a
.github/dependabot.yml to enable package-ecosystem: "github-actions" with a
weekly schedule (or desired cadence) so Dependabot will propose updated action
versions; then replace hard SHAs in the workflow (e.g., the uses entries for
actions/checkout, actions/setup-go, goreleaser/goreleaser-action,
actions/setup-node) with semantic version tags or ranges (or keep caret/major
pins) to allow Dependabot to bump them automatically.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/codeql.yaml:
- Line 44: The workflow comment for the CodeQL checkout is inconsistent with the
pinned SHA: update the line referencing
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd (the current pinned
commit) so the version label matches, or re-pin to the correct v4.35.2 commit
SHA (7fc6561ed893d15cec696e062df840b21db27eb0); specifically edit the uses entry
and its trailing comment (the "# v4.35.2" label) so the SHA and the version
label are aligned with the other CodeQL sub-action pins.

---

Nitpick comments:
In @.github/workflows/release.yml:
- Around line 22-46: The workflow pins GitHub Actions to specific commit SHAs
which requires manual updates; add Dependabot configuration to auto-open PRs for
github-actions updates and prefer version tags or ranges instead of fixed commit
SHAs where acceptable. Create or update a .github/dependabot.yml to enable
package-ecosystem: "github-actions" with a weekly schedule (or desired cadence)
so Dependabot will propose updated action versions; then replace hard SHAs in
the workflow (e.g., the uses entries for actions/checkout, actions/setup-go,
goreleaser/goreleaser-action, actions/setup-node) with semantic version tags or
ranges (or keep caret/major pins) to allow Dependabot to bump them
automatically.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e4bed196-71ed-4774-9880-db2f6f6f6849

📥 Commits

Reviewing files that changed from the base of the PR and between de8a904 and 2f780c2.

📒 Files selected for processing (4)

• .github/workflows/build-test.yml
• .github/workflows/codeql.yaml
• .github/workflows/lint.yml
• .github/workflows/release.yml