[renderbit-technologies]

Pull Request

Description

Pins every uses: reference in .github/workflows/ to a full 40-character commit SHA, with the release tag in a trailing comment (same style as the existing pins in tests.yml). Each action is pinned to the latest release within the major version already in use, so there are no major-version bumps and no other workflow changes.

This resolves Codacy's 2 open "Enforce Pinning of Third-Party GitHub Actions to Full Commit SHA" issues (draft-release.yml:24 shivammathur/setup-php@v2, draft-release.yml:37 softprops/action-gh-release@v3). First-party actions/* are pinned too, for consistency.

Action	Was	Tag	SHA	Files
actions/checkout	@v7	v7.0.1	3d3c42e5aac5ba805825da76410c181273ba90b1	deploy-wporg, draft-release, tests (×6), update-wporg-assets
actions/upload-artifact	@v7	v7.0.2	cf430e030ddbb5b0abf93d22962f4752f3646cd9	tests
actions/setup-node	@v7	v7.1.0	949feb2413d6458794dcd2491c4babbbce0c15c1	tests
shivammathur/setup-php	@v2	2.40.0	eb7c497e18156a6bbabfef1d3a82760b9eda3962 (peeled; same pin tests.yml already uses, no newer 2.x)	draft-release
softprops/action-gh-release	@v3	v3.0.3	efb35369e0ad2afab669f228072c1b0d510eae64 (peeled)	draft-release

.github/dependabot.yml already has a weekly github-actions entry, so Dependabot will keep these pins (and their comments) updated. No change needed there.

Related Issue

None. Addresses Codacy findings on main.

Type of Change

• Chore (maintenance, refactoring, or other non-user-facing changes)

Checklist

• My code follows the project's code style and conventions
• I have read the CONTRIBUTING.md file
• Changes do not introduce security issues

Testing Instructions

• grep -nE 'uses:' .github/workflows/*.yml | grep -vE '@[0-9a-f]{40}' returns nothing.
• Each SHA was checked against git ls-remote https://github.com/<owner>/<repo> refs/tags/<tag> (peeled entry for annotated tags).
• Every workflow parses with Python yaml.safe_load (actionlint wasn't available).
• CI on this PR exercises tests.yml with the new pins. draft-release.yml and the WordPress.org workflows only run on tags/releases/dispatch.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T08:38:20.012201Z	d088984	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

🟢 Approval recommended

Every pinned SHA was verified against its upstream tag and all 22 action references are now correctly pinned, leaving no outstanding findings.

No open issues 🎉

What changed in this PR

This PR hardens CI supply-chain security by pinning every uses: reference in .github/workflows/ to a full 40-character commit SHA, with the release tag preserved in a trailing comment (matching the style already used for other actions in tests.yml). It resolves Codacy's two open "Enforce Pinning of Third-Party GitHub Actions to Full Commit SHA" findings on draft-release.yml (shivammathur/setup-php, softprops/action-gh-release) and extends the same treatment to first-party actions/* for consistency. Each action is pinned to the latest release within its existing major version, so there are no version bumps or behavioral changes.

Changes:

• Pinned actions/checkout, actions/upload-artifact, and actions/setup-node mutable @v7 tags to commit SHAs across all four workflows.
• Pinned shivammathur/setup-php@v2 and softprops/action-gh-release@v3 to commit SHAs in draft-release.yml.
• Each SHA carries a trailing # <tag> comment; verified that all SHAs match their upstream tags (annotated tags correctly pinned to peeled commit SHAs).

File	Description
.github/​workflows/​tests.yml	Pins checkout (×6), upload-artifact, and setup-node to commit SHAs.
.github/​workflows/​draft-release.yml	Pins checkout, setup-php, and action-gh-release — resolves the two Codacy findings.
.github/​workflows/​deploy-wporg.yml	Pins actions/checkout to a commit SHA.
.github/​workflows/​update-wporg-assets.yml	Pins actions/checkout to a commit SHA.

_{Review effort: Balanced}