Pin GitHub workflow actions to immutable commit SHAs

[Copilot]

This change removes mutable action references from repository workflows by replacing tag/branch-based uses: values with fixed commit SHAs. It hardens workflow execution against upstream tag drift while preserving current behavior.

• Scope: workflow supply-chain pinning

  • Updated all .github/workflows/*.yml files that referenced mutable action versions (@v*, @main).

• Pinned GitHub-owned actions

  • actions/checkout@v6 → actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
  • actions/upload-artifact@v7 → actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
  • actions/github-script@v9 → actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3

• Pinned reusable external workflow

  • dotnet/arcade/.github/workflows/inter-branch-merge-base.yml@main → @67a6a00138b6c09d76a2f96bf4cf8b91b55fc52a

• Example transformation

  # before
  - uses: actions/checkout@v6
  
  # after
  - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10

[Copilot]

Pull request overview

This pull request hardens the repo’s GitHub Actions workflows against upstream tag/branch drift by replacing mutable uses: references (e.g., @v*, @main) with immutable commit SHAs, preserving existing workflow behavior while improving supply-chain security.

Changes:

• Pinned actions/github-script invocations to a fixed commit SHA across PR/issue automation workflows.
• Pinned actions/checkout and actions/upload-artifact to fixed commit SHAs in CI and Copilot setup workflows.
• Pinned the dotnet/arcade reusable workflow reference to a fixed commit SHA.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/validate-pr-target-branch.yml	Pins actions/github-script to an immutable SHA for PR target validation.
.github/workflows/label-and-milestone-issues.yml	Pins actions/github-script to an immutable SHA for issue labeling/milestoning automation.
.github/workflows/issues-closed.yml	Pins actions/github-script to an immutable SHA for issue-close automation.
.github/workflows/inter-branch-merge-flow.yml	Pins the dotnet/arcade reusable workflow reference to an immutable SHA.
.github/workflows/copilot-setup-steps.yml	Pins actions/checkout to an immutable SHA for Copilot environment setup validation.
.github/workflows/Build.yml	Pins actions/checkout and actions/upload-artifact to immutable SHAs across CI jobs.
.github/workflows/api-review-baselines.yml	Pins actions/github-script and actions/checkout to immutable SHAs for API baseline review automation.