Security: pin GitHub Actions to SHA hashes

[jorgebraz]

Pins all GitHub Actions from mutable tags/branches to immutable SHA hashes.

This prevents supply chain attacks like the TeamPCP/Trivy incident (March 2026), where attackers force-pushed tags to point at malicious commits.

Auto-generated by the Codacy security audit script.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Alerts:

"

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes. Give us feedback}

[codacy-production]

Pull Request Overview

This PR implements security hardening by pinning GitHub Actions to immutable commit SHAs. While Codacy indicates the code is up to standards, a high-severity logic issue was found in .github/workflows/comment_issue.yml. Specifically, step-level if conditions are attempting to use environment variables defined within the same step, which is unsupported in GitHub Actions and will cause steps to skip incorrectly. Furthermore, while the PR claims to pin all actions, only three workflow files were updated; ensure that other workflows were not inadvertently omitted. Verification of the provided SHAs is also required to ensure they match the commented version tags.

About this PR

• There is no automated verification ensuring that the provided SHAs correctly correspond to the version tags mentioned in the comments. Please verify these mappings manually to prevent accidental use of incorrect or malicious action versions.
• The PR description indicates an intent to pin 'all' actions to SHAs, but only three workflow files were modified. Please confirm if other workflows (such as CI, linting, or deployment) exist in the repository and were intentionally excluded or simply missed in the audit.

Test suggestions

• Verify that 'actions/github-script' at version v2.0.0 correctly resolves to the SHA 6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45.
• Verify that 'atlassian/gajira-login' at version v2.0.0 correctly resolves to the SHA 90a599561baaf8c05b080645ed73db7391c246ed.
• Verify that 'atlassian/gajira-create' at version v2.0.1 correctly resolves to the SHA c0a9c69ac9d6aa063fed57201e55336ada860183.
• Verify that 'atlassian/gajira-comment' at version v2.0.2 correctly resolves to the SHA 8ec356b5df49f1325653db7ee2da2b59a1d78203.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that 'actions/github-script' at version v2.0.0 correctly resolves to the SHA 6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45.
2. Verify that 'atlassian/gajira-login' at version v2.0.0 correctly resolves to the SHA 90a599561baaf8c05b080645ed73db7391c246ed.
3. Verify that 'atlassian/gajira-create' at version v2.0.1 correctly resolves to the SHA c0a9c69ac9d6aa063fed57201e55336ada860183.
4. Verify that 'atlassian/gajira-comment' at version v2.0.2 correctly resolves to the SHA 8ec356b5df49f1325653db7ee2da2b59a1d78203.

---

🗒️ Improve review quality by adding custom instructions

[codacy-production]

_{🔴 HIGH RISK}

The if condition at line 57 (and in the steps at lines 68 and 83) relies on env.GITHUB_ISSUE_TYPE and env.GITHUB_ISSUE_HAS_JIRA_ISSUE_LABEL. Since these are defined in the env block of the step itself, they are not accessible to the if evaluation. You should use the step outputs directly to ensure the condition evaluates correctly.

Try running the following prompt in your coding agent:

In .github/workflows/comment_issue.yml, update all if conditions that check env.GITHUB_ISSUE_TYPE or env.GITHUB_ISSUE_HAS_JIRA_ISSUE_LABEL to use steps.github_issue_type.outputs.result and steps.github_issue_has_jira_issue_label.outputs.result instead.