Pin nested GitHub Action dependencies to full SHAs

[nerrad]

Changes proposed in this Pull Request

Tracking: STORMA-186

• Updates the affected parent actions or reusable workflows to immutable commits whose own remote action dependencies are pinned to full-length SHAs.
• Keeps human-readable version comments beside the SHAs.

This is part of the WooCommerce organization audit for transitive GitHub Action pinning. Shared Grow actions are pinned to the published actions-v3.0.5 release build commit b9c1e59aae9fdbe668b068ebd59c1545a88ea9fa. The action trees used here are identical to the reviewed test build from woocommerce/grow#265.

Detailed test instructions

1. Inspect the changed uses: references and confirm every remote action ref is a 40-character commit SHA.
2. Confirm the adjacent comments identify the intended version or upstream pinning PR.
3. Let the affected workflows run through this PR's hosted checks.

Validation already completed:

• Parsed every GitHub workflow and composite action in this repository as YAML.
• Ran git diff --check.
• Verified the replacement parent commits resolve through their canonical GitHub repositories.
• Verified their nested remote action dependencies are pinned to full-length SHAs.

Documentation

• No documentation changes are required.

Changelog entry

Dev - Pin GitHub Actions and their nested dependencies to immutable commit SHAs.

*left by Biff (AI agent) on behalf of Darren

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (7)

• .github/workflows/branch-labels.yml is excluded by none and included by none
• .github/workflows/build.yml is excluded by none and included by none
• .github/workflows/e2e-tests.yml is excluded by none and included by none
• .github/workflows/js-linting.yml is excluded by none and included by none
• .github/workflows/php-coding-standards.yml is excluded by none and included by none
• .github/workflows/php-unit-tests.yml is excluded by none and included by none
• .github/workflows/prepare-release.yml is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 02e01f1c-1b35-4a98-bd6b-5476de6430bc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[nerrad]

Status update: this PR is impacted by the nested GitHub Action dependency work. I verified that its current head still contains one or more woocommerce/grow references pinned to the temporary test-build commit a81d3fca0166a02a4c25953d250d80d3612db4b8. That commit was suitable for validation, but it is not the permanent release build, so please do not merge this PR yet.

Grow #265 has merged. The actions-v3.0.5 release-preparation workflow is now in progress. Once the release is published, this PR will be updated to the immutable actions-v3.0.5 build SHA, its version comments will be corrected, and its nested-action audit and CI will be rerun before merge.

*left by Biff (AI agent) on behalf of Darren

[nerrad]

Upstream dependency resolved: WooCommerce Grow actions v3.0.5 is now published. This PR has been updated from the temporary test-build SHA (a81d3fca0166a02a4c25953d250d80d3612db4b8) to the immutable release-build SHA (b9c1e59aae9fdbe668b068ebd59c1545a88ea9fa). The corresponding action directory tree hashes are identical, so this is a provenance-only reference change. Hosted checks are re-running.