Pinning GitHub actions

[elgordomac]

Summary by cubic

Pinned GitHub Actions to specific commit SHAs in build and release workflows to meet ENG-11298 and improve security and reproducibility.

• Dependencies
  • actions/checkout pinned to v3.6.0 (build) and v2.7.0 (release).
  • actions/setup-node pinned to v3.9.1 (build) and v1.4.6 (release).

^{Written for commit df1ec31. Summary will update automatically on new commits.}

[Copilot]

Pull request overview

This PR enhances security by pinning GitHub Actions to specific commit hashes rather than mutable version tags. This prevents potential supply chain attacks where action versions could be modified maliciously.

Key changes:

• Pinned actions/checkout and actions/setup-node to specific commit SHAs
• Added version comments for traceability

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/release.yml	Pinned checkout action to v2.7.0 and setup-node to v1.4.6 with commit hashes
.github/workflows/build.yml	Pinned checkout action to v3.6.0 and setup-node to v3.9.1 with commit hashes

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The actions/checkout@v2 action is outdated. This workflow uses v2.7.0 while the build workflow uses v3.6.0. Consider upgrading to v4 (the latest major version) for consistency and to benefit from security updates and improvements. The current v2 version is no longer actively maintained.

Suggested change

	uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
	uses: actions/checkout@v4

[Copilot]

The actions/setup-node@v1 action is outdated. This workflow uses v1.4.6 while the build workflow uses v3.9.1. Consider upgrading to v4 (the latest major version) or at least v3 for consistency with the build workflow and to benefit from security updates and improvements. The v1 version is no longer actively maintained.

Suggested change

	uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6
	uses: actions/setup-node@v4

[cubic-dev-ai]

No issues found across 2 files

[ryoppippi]

LGTM 👍