Security: pin GitHub Actions to SHA hashes

[jorgebraz]

Pins all GitHub Actions from mutable tags/branches to immutable SHA hashes.

This prevents supply chain attacks like the TeamPCP/Trivy incident (March 2026), where attackers force-pushed tags to point at malicious commits.

Auto-generated by the Codacy security audit script.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Alerts:

"

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes. Give us feedback}

[codacy-production]

Pull Request Overview

This PR successfully implements security best practices by pinning GitHub Actions to immutable SHA hashes across all workflow files. Codacy analysis indicates the changes are up to standards with no new quality issues. However, a high-severity logic error was identified in .github/workflows/comment_issue.yml. Step-level environment variables are being referenced in if conditions before they are initialized, which will result in these steps being skipped. This functional regression must be addressed before the PR can be merged.

Test suggestions

• Verify all actions in .github/workflows/comment_issue.yml are pinned to SHAs
• Verify all actions in .github/workflows/create_issue.yml are pinned to SHAs
• Verify all actions in .github/workflows/create_issue_on_label.yml are pinned to SHAs

---

🗒️ Improve review quality by adding custom instructions

[codacy-production]

_{🔴 HIGH RISK}

This step (and subsequent ones) will never execute because the if condition references undefined environment variables. You must use the steps context directly in the if condition to access outputs from previous steps.

Try running the following prompt in your coding agent:

In .github/workflows/comment_issue.yml, update all if conditions to use steps.github_issue_type.outputs.result and steps.github_issue_has_jira_issue_label.outputs.result instead of referencing them via the env context.