testing: fix: pin GitHub Actions to commit SHAs (INT-326)

[Xeboc]

Info

• Pins all uses: references in GitHub Actions workflows to full commit SHAs.

References

• https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions workflow configurations for continuous integration and automated code quality checks.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

This pull request updates multiple GitHub Actions workflow files across the repository. It upgrades action versions in lint.yaml (checkout, trunk-io, and semantic PR actions), removes the Terraform test action from test.yaml and replaces it with an Aqua installer step, adds a new workflow file tester.yaml that performs Aqua installation, and updates action versions in trunk-upgrade.yaml (checkout and trunk-upgrade actions). The changes involve version pinning updates and workflow step restructuring without altering job structure, triggers, or overall control flow.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

The diff spans four workflow files with mixed complexity: simple version upgrades in lint.yaml and trunk-upgrade.yaml, a structural replacement of a step in test.yaml, and a new workflow addition in tester.yaml. While individual version updates follow a repetitive pattern, the removal of the Terraform test action and introduction of Aqua installer configuration requires separate verification of compatibility and intent. The heterogeneous nature of changes across multiple files and the presence of both cosmetic and structural modifications place this in the moderate complexity range.

Possibly related PRs

• chore: sync with template terraform-spacelift-policies#11: Modifies the same GitHub Actions workflow files (test.yaml and trunk-upgrade.yaml) with updates to identical action pinnings and configurations.
• feat(trunk): add trunk + workflows masterpoint.io#60: Updates and bumps action versions in the same workflow files (lint.yaml and trunk-upgrade.yaml) with overlapping dependency changes.
• chore(gha): run gha version pin rule terraform-aws-identity-center-users#10: Modifies trunk-upgrade.yaml with related changes to actions/checkout and masterpointio/github-action-trunk-upgrade action versions.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: pinning GitHub Actions to commit SHAs across multiple workflows, which directly aligns with all the file modifications shown in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/INT-326/pin-github-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}