Pin GitHub Actions to commit SHAs

[joe4dev]

Motivation

Every external action in our workflows was referenced by a mutable tag (@v7, @v1). A tag is a pointer the upstream owner can move at any time, so anyone who controls one of these 15 repositories — or anyone who compromises one — can change what runs inside our CI. That matters more here than in most repos: these workflows hold PRO_ACCESS_TOKEN, NPM_AUTH_TOKEN, and the goreleaser signing path, and ci.yml is the workflow the weekly release calls. A retagged action is enough to publish an lstk build we didn't write.

enforce-labels.yml and sync-labels.yml were already pinned (#307). This finishes the job.

Solution

All 45 external uses: refs across 6 workflows are now pinned to full 40-character commit SHAs with a trailing # vX.Y.Z comment.

No change to what CI executes. Each SHA is the commit the floating tag pointed at when this branch was cut — resolved with gh api repos/<owner>/<repo>/commits/<tag>, not a version bump. I then listed every tag pointing at that same commit to derive an honest version comment, so actions/checkout@v7 is recorded as the v7.0.1 it actually resolves to. One exception worth knowing: aws-actions/setup-sam publishes only major tags, so no patch tag exists at that commit and its comment reads # v3.

Dependabot's existing github-actions ecosystem understands SHA pins and bumps the hash and the comment together, so pinning does not freeze updates.

The 3 local refs (./.github/workflows/ci.yml, ./.github/actions/create-release-tag) are intentionally untouched — they are checked out with the repo and have no upstream to retag.

CLAUDE.md gains a short # GitHub Actions section recording the convention and the gh api recipe, so the next workflow edit doesn't reintroduce a floating tag.

Verification

• A grep for external refs lacking a 40-char SHA returns nothing.
• git diff -U0 confirms only uses: lines changed — 45 of them, no incidental edits.
• All 11 .github/**/*.yml files still parse.
• Independently confirmed by zizmor: run against pre-pin main it reports 45 unpinned-uses findings, and zero against this branch.

CI passing on this PR is the real check, since this only touches CI.

Docs

Nothing to document.

No user-facing lstk behavior, flags, config, or output changes. The only prose added is agent-facing guidance in CLAUDE.md.

Review

Self-merge candidate. Mechanical, behavior-preserving by construction, and fully checkable from the diff — every line is a tag-to-SHA swap whose correctness a reviewer can confirm with gh api repos/<owner>/<repo>/commits/<tag>.

One judgment call to flag rather than bury: pinning to the current tag target rather than to the newest patch release means we adopt no upstream changes in this PR. I think that's right for a security-hygiene change — pin now, let Dependabot bump deliberately — but it does mean the version comments are a snapshot, and sync-labels.yml's pre-existing pin is commented # main while localstack/meta main has since moved 8 commits ahead. Left alone here; worth a follow-up.

Closes DEVX-978

Co-Authored-By: Claude noreply@anthropic.com