ci: pin GitHub Actions to commit SHAs

Replace all mutable action/reusable-workflow tag references in the
workflows with the immutable commit SHA they currently resolve to,
keeping the original version as a trailing comment for readability and
future bumps. This hardens the CI supply chain against tag-mutation
attacks (per GitHub's hardening guidance).

Covers third-party actions (actions/*, astral-sh/setup-uv,
codecov/codecov-action, peter-evans/create-pull-request,
mikepenz/release-changelog-builder-action, github/codeql-action,
crate-ci/typos) and the NVIDIA-NeMo/FW-CI-templates reusable workflows.
Local ./.github reusable-workflow references are unchanged (not tags).

Signed-off-by: svcnemo-autobot <svcnemo-autobot@nvidia.com>

Author: svcnemo-autobot

.github/workflows/changelog-build.yml

@@ -22,14 +22,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: main
           fetch-depth: 0
 
       - name: Build Changelog
         id: github_tag
-        uses: mikepenz/release-changelog-builder-action@v3.3.1
+        uses: mikepenz/release-changelog-builder-action@000e44613cdb6c340ac98cb1582f99e8d3230058 # v3.3.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -80,7 +80,7 @@ jobs:
         run: cat CHANGELOG.md
 
       - name: Create or update label
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const labelName = '${{ inputs.release-branch }}';
@@ -112,7 +112,7 @@ jobs:
             }
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
         with:
           commit-message: "beep boop: Update changelog"
           title: "Update changelog for `${{ inputs.release-branch }}`"

.github/workflows/cherry-pick-release-commit.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   cherry-pick:
-    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_cherry_pick.yml@v0.63.0
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_cherry_pick.yml@8ebb3aec4c246c944a25adc7b09107cbd6a76976 # v0.63.0
     secrets:
       PAT: ${{ secrets.PAT }}
       SLACK_WEBHOOK_ADMIN: ${{ secrets.SLACK_WEBHOOK_ADMIN }}

.github/workflows/close-inactive-issue-pr.yml

@@ -5,4 +5,4 @@ on:
 
 jobs:
   close-issues:
-    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_close_inactive_issue_pr.yml@v0.44.0
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_close_inactive_issue_pr.yml@9e07489b8a6bc533c8792099b012c588f4430298 # v0.44.0

.github/workflows/codeql.yml

@@ -38,11 +38,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -57,7 +57,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -70,6 +70,6 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/community-bot.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   community-bot:
-    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_community_bot.yml@v0.54.4
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_community_bot.yml@a8006e87bff5bce54336c3e1e8571563ac70d88e # v0.54.4
     with:
       community_project_id: ${{ vars.COMMUNITY_PROJECT_ID }}
     secrets:

.github/workflows/copyright-check.yml

@@ -20,4 +20,4 @@ on:
 
 jobs:
   copyright-check:
-    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_copyright_check.yml@v0.54.4
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_copyright_check.yml@a8006e87bff5bce54336c3e1e8571563ac70d88e # v0.54.4

.github/workflows/detect-secrets.yml

@@ -18,4 +18,4 @@ on:
 
 jobs:
   secrets-detector:
-    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_secrets-detector.yml@v0.74.0
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_secrets-detector.yml@859ae21dd5588c87e3bde499ddab7a3025773e8d # v0.74.0

.github/workflows/install.yml

@@ -16,10 +16,10 @@ jobs:
         os: [ubuntu-latest, macos-latest, ubuntu-22.04-arm]
         python: ["3.10", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "${{ matrix.python }}"
 

.github/workflows/nightly.yml

@@ -17,10 +17,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: [format, lint, test]
     steps:
-        - uses: actions/checkout@v6
+        - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
         - name: Create nightly tag
-          uses: actions/github-script@v8
+          uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
           with:
             script: |
                 // Delete existing nightly tag if it exists

.github/workflows/release-docs.yml

@@ -78,15 +78,15 @@ on:
 
 jobs:
   build-docs:
-    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_build_docs.yml@v0.67.0
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_build_docs.yml@3ab507cd035df3ae37cce8808ed3210ff6e7062b # v0.67.0
     with:
       ref: ${{ inputs.github-ref }}
 
   publish-docs:
     runs-on: ubuntu-latest
     needs: [build-docs]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           repository: NVIDIA-NeMo/FW-CI-templates
           ref: v0.74.0