ci: pin GitHub Actions to commit SHAs

[jamesarich]

What

SHA-pins all mutable-tag third-party GitHub Actions in the build workflows to commit SHAs (supply-chain hardening per standard §5.3). The immutable version is preserved in a trailing # vX.Y.Z comment so Renovate can still track and bump them.

Pinned refs

.github/workflows/ci.yml

• actions/checkout v7 → 3d3c42e (v7.0.1)
• actions/setup-java v5 → 03ad4de (v5.6.0)
• gradle/actions/setup-gradle v6 → 3f131e8 (v6.2.0)
• actions/cache v6 → 55cc834 (v6.1.0)
• codecov/codecov-action v7 → fb8b358 (v7.0.0)

.github/workflows/release.yml

• actions/checkout v7 → 3d3c42e (v7.0.1)
• actions/setup-java v5 → 03ad4de (v5.6.0)
• gradle/actions/setup-gradle v4 → 3f131e8 (v6.2.0) — the stray @v4 is unified up to v6.2.0 per §5.2, matching the v6 used in ci.yml/docs.yml
• actions/attest-build-provenance v4 → 0f67c3f (v4.1.1)
• softprops/action-gh-release v3 → 3d0d988 (v3.0.2)

Out of scope

• docs.yml was already fully SHA-pinned (checkout/setup-java/setup-gradle plus the Pages actions) — no changes needed.
• codeql.yml / scorecard.yml already pinned — left as-is.
• No local uses: ./… refs touched.

Verification

grep -rnE 'uses: [a-zA-Z].*@v[0-9]' .github/workflows/ returns no remaining third-party mutable refs.

Summary by CodeRabbit

• Chores
  • Updated continuous integration and release automation components to verified, pinned versions.
  • Improved build and release workflow consistency without changing existing steps or commands.

[coderabbitai]

📝 Walkthrough

Walkthrough

GitHub Actions in the CI and release workflows are updated from floating major-version tags to specific commit SHAs, with version comments retained. Workflow steps, inputs, commands, and job logic remain unchanged.

Changes

Workflow action pinning

Layer / File(s)	Summary
CI action pins .github/workflows/ci.yml	Checkout, Java, Gradle, Kotlin/Native cache, and Codecov actions now use commit-pinned references.
Release action pins .github/workflows/release.yml	Checkout, Java, Gradle, provenance attestation, and release actions now use commit-pinned references.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Poem

A rabbit checks each workflow line,
And pins the actions neat and fine.
No tags can hop, no versions stray,
SHAs keep the build in stay.
“CI carrots!” cheers the hare.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: pinning GitHub Actions to commit SHAs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/ci.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/release.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/release.yml (1)

113-113: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Consider replacing the release action with gh release.

This would remove a third-party action from a privileged release job and reduce supply-chain surface. Preserve the current tag, title, notes, and generate_release_notes behavior if adopting it.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml at line 113, Replace the third-party
softprops/action-gh-release step in the release workflow with GitHub CLI gh
release commands, preserving the existing tag, title, notes, and
generate_release_notes behavior. Ensure the release job authenticates gh with
the existing GitHub token and continues attaching any currently configured
assets.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/release.yml:
- Line 113: Replace the third-party softprops/action-gh-release step in the
release workflow with GitHub CLI gh release commands, preserving the existing
tag, title, notes, and generate_release_notes behavior. Ensure the release job
authenticates gh with the existing GitHub token and continues attaching any
currently configured assets.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fdd0c1b8-2a53-4172-94b7-316dd0ceb81a

📥 Commits

Reviewing files that changed from the base of the PR and between e4fc96a and a7dbf1f.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .github/workflows/release.yml