Pin GitHub Actions to immutable commit SHAs

.agents/skills/.gitignore

@@ -17,5 +17,7 @@
 !cosmosdb-mongodb/**
 !documentation/
 !documentation/**
+!github-actions/
+!github-actions/**
 !vscode-electron-worker/
 !vscode-electron-worker/**

.agents/skills/github-actions/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: github-actions
+description: Use when creating, editing, reviewing, or troubleshooting GitHub Actions workflows in Scope.
+metadata:
+  version: "1.0.0"
+---
+
+# GitHub Actions
+
+Every external action or reusable workflow under `.github/workflows/` must use
+a full 40-character commit SHA followed by its release version comment. Local
+actions (`./...`) and container actions (`docker://...`) are exempt.
+
+Use `pinact run` to add or update pins instead of resolving SHAs manually.
+Preserve the selected action version unless the task explicitly requests an
+upgrade.
+
+Before completion, run:
+
+```bash
+pinact run --check --verify-comment
+pnpm exec vitest run scripts/ci-workflow.test.ts
+```
+
+Do not hand-edit generated `*.lock.yml` workflows. Update their owning gh-aw
+Markdown source and run `gh aw compile`.

.github/pinact.yaml

@@ -0,0 +1,15 @@
+version: 3
+
+files:
+  - pattern: workflows/*.yml
+  - pattern: workflows/*.yaml
+
+rules:
+  # gh-aw owns generated lockfile annotations. Preserve its major-version
+  # comments while the Vitest invariant still enforces a full SHA and comment.
+  - ignore: true
+    conditions:
+      - expr: ActionName == "github/gh-aw-actions/setup"
+      - expr: ActionName == "actions/github-script" && VersionComment == "v8"
+      - expr: ActionName == "actions/upload-artifact" && VersionComment == "v7"
+      - expr: ActionName == "actions/download-artifact" && VersionComment == "v8"

.github/workflows/check-worker-versions.yml

@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # pnpm/action-setup@v4 is not allowed on EMU
       - name: Install pnpm
@@ -55,7 +55,7 @@ jobs:
           pnpm --version
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
           registry-url: "https://registry.npmjs.org"