Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/india to immutable commit SHAs.

Summary

Metric	Count
Files changed	3
Files scanned	2
Refs found	7
Refs pinned	7
Skipped refs	0
Warnings	1
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/trigger-deploy-on-comment.yml:11	actions/github-script@v6	actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410	tag
.github/workflows/trigger-deploy-on-comment.yml:21	benc-uk/workflow-dispatch@v1	benc-uk/workflow-dispatch@d004979be141727c7a17c28f603e2facc40d0855	tag
.github/workflows/website-pr-validation.yml:14	actions/checkout@v3	actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26	tag
.github/workflows/website-pr-validation.yml:17	ibiqlik/action-yamllint@v3	ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c	tag
.github/workflows/website-pr-validation.yml:45	actions/checkout@v3	actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26	tag
.github/workflows/website-pr-validation.yml:47	actions/checkout@v3	actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26	tag
.github/workflows/website-pr-validation.yml:52	ruby/setup-ruby@v1	ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b	branch

Dependabot

• Added .github/dependabot.yml enabling weekly github-actions updates with a 7-day cooldown (cooldown: default-days: 7).
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

Warnings

Location	Ref	Reason
.github/workflows/website-pr-validation.yml:52	ruby/setup-ruby@v1	pinned mutable branch ref 'v1' to 95ef2b042f9d; review carefully because the source branch can move

---

Generated by pinner 0.1.0.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.