[Cedric Vidal (cedricvidal)]

Summary

Microsoft will require full-length commit SHA pinning for GitHub Actions beginning December 4, 2026. This change replaces all mutable external workflow references with immutable SHAs and exact version comments, then adds two regression layers: a dedicated validation-only pinact check and an independent Vitest repository invariant.

The pinact workflow uses read-only permissions, generated gh-aw lockfile annotation conventions remain generator-owned through narrowly scoped pinact rules, and a concise project skill activates pinning guidance only for GitHub Actions work.

Closes #1627

Demos

N/A - repository workflow security and CI validation only.

Before

N/A

After

N/A

Testing

• pinact run --check --verify-comment - passed.
• pnpm exec vitest run scripts/ci-workflow.test.ts --reporter=default - passed, 34 tests.
• Local skill parser/frontmatter validation - passed with a 92-character trigger-only description and no warnings.
• Repository-wide external action scan - passed, 141 references and 0 mutable references.
• Workflow YAML parse check - passed for every .github/workflows/*.{yml,yaml} file.
• git diff --check - passed.
• pnpm lint - not completed because the existing workspace lint scripts invoke eslint, but no workspace package manifest declares that executable (eslint: command not found).

Documentation and compatibility

Added the scoped .agents/skills/github-actions/ project skill and updated CONTRIBUTING.md with the immutable action reference policy, required version annotations, pinact workflow, and validation commands. Project skills are user-controlled instruction data rather than Scope-owned runtime static prompt families, so no static prompt evaluation update is required. No API, CLI, data, or runtime compatibility changes. No dependency or lockfile changes.

Checklist

• If Portal features changed, keep CLI capabilities in sync. N/A - no Portal changes.
• If Portal components changed, update their Storybook stories. N/A - no Portal component changes.
• If database changes require a migration, include up() / down() and keep it CosmosDB-compatible. N/A - no database changes.
• If dependencies changed, update the lockfile and regenerate NOTICE / NOTICE-REVIEW.txt with pnpm notice as needed. N/A - no dependency changes.
• Video showing the behavior before the suggested change. N/A - not user-visible.
• Video showing the behavior after the suggested change. N/A - not user-visible.

[Cedric Vidal (cedricvidal)]

Superseded by #1630, which uses the branch hosted directly in microsoft/scope.