GH Pin SHA for security and Stability.

[Tatsinnit]

Pinning dependencies is a best practice in software development because it ensures reliability, security, and consistency across builds and deployments. For general audience, here’s why it’s beneficial:

1. Ensures Build Stability

• If you use floating versions (e.g., @latest, @v5), a new release could break your workflow unexpectedly.
• Pinning to a specific version or SHA ensures that the same version is used every time.

Example:

# Unpinned (Risky)
- uses: actions/setup-go@v5  # May change with updates

# Pinned (Stable)
- uses: actions/setup-go@c7c5d76577b5e477c72e5e48b2f29a85266e1a29  # Uses exact commit SHA

2. Improves Security

• Floating versions can introduce supply chain attacks if a dependency is compromised.
• Pinning a SHA ensures that you are only using a verified version of an action or library.

Lets always Pin Dependencies for Reliability & Security.

Pinning dependencies prevents unexpected failures, security risks, and inconsistent behavior across environments

Starting for this repo for now next up I will add the dependabot for this repo for these things for future update and share across for evangelism. Thanks heaps ❤️ fyi @davidgamero

[Copilot]

Copilot reviewed 5 out of 8 changed files in this pull request and generated no comments.

Files not reviewed (3)

• .github/workflows/e2e-info.yml: Evaluated as low risk
• .github/workflows/integration-install.yml: Evaluated as low risk
• .github/workflows/integration-json.yml: Evaluated as low risk

[Vidya2606]

lgtm!

[davidgamero]

lgtm