[nachorpaez]

Why

The sourcegraph org now enforces the GitHub Actions policy "Require actions to be pinned to a full-length commit SHA". A job that references an action by tag or branch (for example actions/checkout@v4 or @main) now fails at "Set up job" with:

The action … is not allowed … because all actions must be pinned to a full-length commit SHA.

This fork still runs CI, and its workflows referenced actions by tag or branch, so those runs would start failing.

What changed

• Every uses: in .github/workflows/, .github/actions/ and action.yml files is pinned to a full commit SHA. Each pin has a version comment, such as actions/checkout@<sha> # v4.2.2.
• Tags were pinned with pinact v5.0.2, to the commit each tag points to today. The code that runs doesn't change.
• Branch refs (@main, @master) were pinned to the branch's current head commit, with the branch name as the comment.
• I checked every pinned composite action and reusable workflow for tag references inside it, because the policy blocks those too. I found none.

Bumping actions later

Change the SHA and its comment together. Either let Dependabot (github-actions ecosystem) open the bump, or run pinact run --update, which updates both. Don't go back to a bare tag: the policy rejects it.