chore: merging dev to main

[Priyanka2-Microsoft]

Purpose

• This pull request updates the pinned versions of GitHub Actions used across multiple workflow files to reference specific commit SHAs instead of floating tags. This change improves the security and reliability of the CI/CD pipelines by ensuring that the exact version of each action is used, preventing unexpected changes due to upstream updates.

The most important changes are:

Security and Reliability Improvements:

• Updated all actions/checkout, docker/setup-buildx-action, azure/login, Azure/setup-azd, actions/upload-artifact, and other commonly used actions to reference specific commit SHAs rather than version tags in all workflow files (e.g., .github/workflows/CI.yml, .github/workflows/job-deploy-linux.yml, .github/workflows/test-automation.yml). This ensures deterministic builds and mitigates risks from upstream changes. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26]

Dependency Updates:

• Bumped versions for several third-party actions (such as tj-actions/changed-files, lycheeverse/lychee-action, microsoft/template-validation-action, github/codeql-action, actions/stale, amannn/action-semantic-pull-request) to newer commit SHAs, ensuring up-to-date features and fixes while still locking to a specific version. [1] [2] [3] [4] [5] [6] [7] [8]

These changes collectively enhance the security, stability, and maintainability of the CI/CD workflows by making the execution environment more predictable and less susceptible to supply chain risks.

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Pull request overview

This pull request hardens the repository’s GitHub Actions workflows by replacing third-party uses: version tags with pinned commit SHAs, improving supply-chain security and build reproducibility across CI, validation, deployment, and automation workflows.

Changes:

• Pinned commonly used GitHub Actions (e.g., checkout, setup-python, upload-artifact, CodeQL, Azure login, azd setup) to specific commit SHAs across multiple workflows.
• Applied the pinning pattern broadly to CI, CodeQL, deployment jobs, and automation workflows to standardize action versioning.
• Included at least one stated “version bump” via comment update (e.g., tj-actions/changed-files), though the pinned SHA may not have changed.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/validate-bicep-params.yml	Pins checkout/setup-python/upload-artifact to SHAs for deterministic Bicep param validation.
.github/workflows/test-automation.yml	Pins checkout/setup-python/upload-artifact to SHAs for the E2E test workflow.
.github/workflows/test-automation-v2.yml	Pins checkout/setup-python/azure-login/upload-artifact to SHAs for the Azure-based test workflow.
.github/workflows/stale-bot.yml	Pins stale/checkout/upload-artifact to SHAs for stale triage and branch reporting.
.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml	Pins checkout to a SHA for scheduled Dependabot auto-merge automation.
.github/workflows/pr-title-checker.yml	Pins semantic PR title checker action to a SHA.
.github/workflows/job-deploy.yml	Pins checkout and azure/login to SHAs in the deploy job workflow.
.github/workflows/job-deploy-linux.yml	Pins checkout, buildx, setup-azd, and azure/login to SHAs in Linux deploy workflow.
.github/workflows/job-cleanup-deployment.yml	Pins azure/login to a SHA for cleanup workflow reliability.
.github/workflows/codeql.yml	Pins checkout and CodeQL actions to SHAs for reproducible analysis runs.
.github/workflows/CI.yml	Pins checkout/buildx/setup-azd/azure-login to SHAs for CI consistency.
.github/workflows/broken-links-checker.yml	Pins checkout/changed-files/lychee-action to SHAs for deterministic broken-link checks.
.github/workflows/azure-dev.yml	Pins checkout/setup-azd/azure-login to SHAs for Azure dev workflow stability.
.github/workflows/azd-template-validation.yml	Pins checkout and template-validation action to SHAs for template validation determinism.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.