fix: Pin GitHub Actions to commit SHAs

[PrekshithD-Microsoft]

This pull request updates workflow files to improve security and maintainability by pinning GitHub Actions to specific commit SHAs instead of floating tags. Additionally, it enhances the deployment process by adding a user notice before provisioning. Below are the most important changes grouped by theme:

Security and Maintenance: Pinning GitHub Actions to SHAs

• Updated all actions/checkout usages in workflow files (such as .github/workflows/azd-template-validation.yml, azure-dev.yml, broken-links-checker.yml) to reference a specific commit SHA instead of a version tag, ensuring builds use a known, immutable version. [1] [2] [3]
• Pinned other GitHub Actions (e.g., microsoft/template-validation-action, Azure/setup-azd, azure/login, lycheeverse/lychee-action, amannn/action-semantic-pull-request, actions/stale) to specific SHAs in their respective workflow files for improved security and reproducibility. [1] [2] [3] [4] [5] [6] [7]

Deployment Experience Improvement

• Added a preprovision PowerShell hook in azure.yaml to display a deployment notice to users, encouraging them to open an issue with logs if deployment fails, improving user guidance and support.## Purpose

• ...

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Pull request overview

This PR aims to harden and stabilize CI/CD by pinning GitHub Actions to immutable commit SHAs (instead of floating tags), improving supply-chain security and workflow reproducibility.

Changes:

• Pinned multiple GitHub Actions uses: references (e.g., actions/checkout, azure/login, actions/stale, lychee-action, semantic PR title checker) to specific commit SHAs.
• Updated the azd template validation workflow to use a pinned SHA for microsoft/template-validation-action.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/stale-bot.yml	Pins actions/stale to a commit SHA.
.github/workflows/pr-title-checker.yml	Pins the semantic PR title checker action to a commit SHA.
.github/workflows/broken-links-checker.yml	Pins actions/checkout and lycheeverse/lychee-action to commit SHAs.
.github/workflows/azure-dev.yml	Pins actions/checkout, Azure/setup-azd, and azure/login to commit SHAs.
.github/workflows/azd-template-validation.yml	Pins actions/checkout and microsoft/template-validation-action to commit SHAs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/create-release.yml:25

• Using uses: docker://...@sha256:... runs a raw container image, not the codfish/semantic-release-action repository action. In that mode, the custom inputs under with: (e.g. tag-format, additional-packages, plugins) will not be interpreted as action inputs, and the step is likely to break or silently ignore configuration. Prefer pinning the action repository to a commit SHA (e.g. codfish/semantic-release-action@<sha>) so the existing with: inputs remain supported.

      - uses: docker://ghcr.io/codfish/semantic-release-action@sha256:c6a4e05d93f73f2870887434c1286df7a23a55770be16cb826b6e2432f92e650 # v5.0.0
        id: semantic
        with:
          tag-format: "v${version}"
          additional-packages: |

.github/workflows/create-release.yml:19

• create-release.yml is triggered by on: push, but the checkout step sets ref: ${{ github.event.workflow_run.head_sha }}, which is not present on push events. This can resolve to an empty ref and lead to checking out the wrong commit or failing checkout. Use github.sha (or omit ref entirely) for push-triggered workflows.

        with:
          ref: ${{ github.event.workflow_run.head_sha }}

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

.github/workflows/create-release.yml:7

• create-release.yml now triggers on pushes to psl-workflow-update in addition to main. This is unrelated to action pinning and can unintentionally create releases from a non-main branch if someone pushes to it. If this was only for testing, prefer using workflow_dispatch or a temporary change in the PR branch rather than merging an extra release branch trigger.

  push:
    branches:
      - main
      - psl-workflow-update

.github/workflows/create-release.yml:20

• This workflow is triggered by push, but actions/checkout is configured with ref: ${{ github.event.workflow_run.head_sha }}. github.event.workflow_run is not present for push events, so this evaluates to empty and can break checkout. Use github.sha (or omit ref entirely) for push-triggered workflows.

      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.event.workflow_run.head_sha }}

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

.github/workflows/create-release.yml:27

• Switching from codfish/semantic-release-action@v3 to uses: docker://... changes this from a GitHub Action (with action.yml-defined inputs) to a raw container image reference. The current step still passes many custom with: inputs (tag-format, plugins, etc.), which are unlikely to be supported/validated for a docker:// step and can break the workflow. If the goal is just immutability, prefer pinning the action repo to a commit SHA instead of switching to docker://, or update the step to pass only supported container parameters (e.g., args/entrypoint) and required env vars.

      - uses: docker://ghcr.io/codfish/semantic-release-action@sha256:c6a4e05d93f73f2870887434c1286df7a23a55770be16cb826b6e2432f92e650 # v5.0.0
        id: semantic
        with:
          tag-format: "v${version}"
          additional-packages: |
            ['conventional-changelog-conventionalcommits@7']
          plugins: |

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/create-release.yml:21

• actions/checkout is configured with ref: ${{ github.event.workflow_run.head_sha }}, but this workflow is triggered by push and workflow_dispatch (not workflow_run). On those events github.event.workflow_run is undefined, so ref evaluates to an empty string and checkout can fail or fetch the wrong revision. Use github.sha (or remove ref entirely) so the workflow checks out the triggering commit consistently.

      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.event.workflow_run.head_sha }}

.github/workflows/create-release.yml:26

• This step switches from codfish/semantic-release-action@... to a raw docker://... image reference. For docker:// steps, GitHub Actions only supports with: args (other action inputs like tag-format, plugins, etc. are not wired up), so these with: values will be ignored and the release behavior will likely break. To keep inputs working while still pinning, use the repository action syntax (uses: codfish/semantic-release-action@<commit_sha>) pinned to an immutable commit SHA, rather than calling the container image directly.

      - uses: docker://ghcr.io/codfish/semantic-release-action@sha256:c6a4e05d93f73f2870887434c1286df7a23a55770be16cb826b6e2432f92e650 # v5.0.0
        id: semantic
        with:
          tag-format: "v${version}"
          additional-packages: |

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/create-release.yml:25

• uses: docker://... runs a raw container image, not the codfish/semantic-release-action GitHub Action. As a result, the with: inputs (e.g., tag-format, plugins) and declared outputs (steps.semantic.outputs.*) will not be interpreted the same way as when using the action via codfish/semantic-release-action@..., and this workflow is likely to break or silently ignore configuration. Prefer pinning the action itself to a commit SHA (or keep the action form) rather than switching to a bare docker image reference.

      - uses: docker://ghcr.io/codfish/semantic-release-action@sha256:c6a4e05d93f73f2870887434c1286df7a23a55770be16cb826b6e2432f92e650 # v5.0.0
        id: semantic
        with:
          tag-format: "v${version}"
          additional-packages: |

.github/workflows/create-release.yml:20

• This workflow is triggered by on: push, but checkout is using ref: ${{ github.event.workflow_run.head_sha }}, which is not present for push events. This can result in checking out the default ref (or failing), rather than the commit that triggered the workflow. Use ${{ github.sha }} for push-triggered workflows (or switch the workflow trigger to workflow_run if that’s the intent).

        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.event.workflow_run.head_sha }}