Pin CI actions to full-length commit SHAs

.github/copilot-instructions.md

@@ -67,7 +67,8 @@ enough to explain alongside the CI workflow.
 
 - Verify the contributor's intended repository and authenticated identity before
   remote operations. Never embed a maintainer's account, token or machine path.
-- Actions uses `pull_request`, supported action release tags and `contents: read`. Do not execute
+- Actions uses `pull_request` and `contents: read`. Pin checkout, Python setup and
+  artifact upload to full-length commit SHAs with release-version comments. Do not execute
   untrusted PR code through `pull_request_target` or add personal tokens.
 - Emulator tests require no Azure credentials. Its public SDK test key does not
   prove authentication; the emulator does not enforce authorization.

.github/workflows/agentic-ci.yml

@@ -31,11 +31,11 @@ jobs:
       PIP_DISABLE_PIP_VERSION_CHECK: "1"
     steps:
       - name: Check out the tested revision
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Set up Python 3.12
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.12"
       - name: Install uv 0.13.0 from Microsoft
@@ -47,7 +47,7 @@ jobs:
         run: uv run --locked --extra test python -m scripts.agent_ci --task ${{ matrix.task }}
       - name: Preserve task results and diagnostics
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: agent-task-${{ matrix.task }}-${{ github.run_attempt }}
           path: .artifacts/agent-ci/
@@ -71,11 +71,11 @@ jobs:
       PIP_DISABLE_PIP_VERSION_CHECK: "1"
     steps:
       - name: Check out the trusted default-branch revision
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Set up Python 3.12
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.12"
       - name: Set up Node.js 24
@@ -101,7 +101,7 @@ jobs:
             --agent-command 'copilot -p "{prompt}" -s --allow-all-tools --no-ask-user --disable-builtin-mcps --no-custom-instructions --secret-env-vars=GITHUB_TOKEN --max-ai-credits 30'
       - name: Preserve real-agent patches, test results and diagnostics
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: copilot-swarm-${{ github.run_attempt }}
           path: .artifacts/agent-swarm/
@@ -118,11 +118,11 @@ jobs:
       PIP_DISABLE_PIP_VERSION_CHECK: "1"
     steps:
       - name: Check out the tested revision
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Set up Python 3.12
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.12"
       - name: Install uv 0.13.0 from Microsoft
@@ -134,7 +134,7 @@ jobs:
         run: uv run --locked --extra test python -m scripts.agent_isolation
       - name: Preserve isolation results and diagnostics
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: agent-isolation-${{ github.run_attempt }}
           path: .artifacts/agent-isolation/
@@ -152,11 +152,11 @@ jobs:
       PIP_DISABLE_PIP_VERSION_CHECK: "1"
     steps:
       - name: Check out the tested revision
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Set up Python 3.12
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.12"
       - name: Install uv 0.13.0 from Microsoft
@@ -168,7 +168,7 @@ jobs:
         run: uv run --locked --extra test python -m scripts.agent_swarm
       - name: Preserve swarm results and diagnostics
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: agent-swarm-${{ github.run_attempt }}
           path: .artifacts/agent-swarm/

.github/workflows/azure-cd-example.yml

@@ -74,7 +74,7 @@ jobs:
       id-token: write
     steps:
       - name: Check out the selected revision
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
@@ -107,7 +107,7 @@ jobs:
           done
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.12"
 

.github/workflows/emulator-ci.yml

@@ -22,11 +22,11 @@ jobs:
       PIP_DISABLE_PIP_VERSION_CHECK: "1"
     steps:
       - name: Check out the tested revision
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Set up Python 3.12
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.12"
       - name: Install uv 0.13.0 from Microsoft
@@ -43,7 +43,7 @@ jobs:
         run: python -m scripts.ci_report --suite emulator
       - name: Preserve test results and emulator diagnostics
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: emulator-results-${{ github.run_attempt }}
           path: .artifacts/
@@ -64,11 +64,11 @@ jobs:
       OLLAMA_MAX_LOADED_MODELS: "1"
     steps:
       - name: Check out the tested revision
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Set up Python 3.12
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.12"
       - name: Install uv 0.13.0 from Microsoft
@@ -122,7 +122,7 @@ jobs:
         run: python -m scripts.ci_report --suite ollama
       - name: Preserve live-model results and diagnostics
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: ollama-results-${{ github.run_attempt }}
           path: .artifacts/

README.md

@@ -401,7 +401,8 @@ plus manual dispatch:
 - **Real agent, grounded answers and CRUD:** Ollama, Microsoft Phi-3.5,
   a separate emulator and the actual application test.
 
-CI uses a disposable Ubuntu runner, loopback services, supported action release tags and
+CI uses a disposable Ubuntu runner, loopback services, full-length commit SHA pins
+for checkout, Python setup and artifact upload (with release-version comments), and
 `contents: read`. It needs no Azure subscription, inference API key or repository
 secret. Both jobs fail on incorrect results; configure repository rules to make
 their checks mandatory before merge.