Changed pinned version from main to commit sha for actions from https://github.com/cap-java/.github

[lisajulia]

Pin GitHub Actions to Commit SHA Instead of main Branch

Chore

🔧 Updated all GitHub Actions workflow references from the mutable @main branch tag to a pinned commit SHA (296573b55e906f5c77a1855bcfe4285cbbc5cac4), with #main retained as a comment for readability. This improves security and reproducibility by ensuring workflows use a specific, immutable version of the shared actions rather than a floating branch reference.

Changes

• .github/workflows/issue.yml: Pinned reusable workflow reference from @main to @296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main.
• .github/workflows/main.yml: Pinned references for scan-with-blackduck action and pipeline.yml reusable workflow.
• .github/workflows/pipeline.yml: Pinned references for cf-bind, integration-tests, scan-with-sonar, and scan-with-codeql actions.
• .github/workflows/pr.yml: Pinned references for scan-with-blackduck action and pipeline.yml reusable workflow.
• .github/workflows/prevent-issue-labeling.yml: Pinned reusable workflow reference.
• .github/workflows/release.yml: Pinned references for scan-with-blackduck, build, and deploy-release actions.
• .github/workflows/stale.yml: Pinned reusable workflow reference.

• 🔄 Regenerate and Update Summary

PR Bot Information

Version: 1.21.1

• Correlation ID: 2b85514d-75a9-490b-97fe-e1e873d76a39
• LLM: anthropic--claude-4.6-sonnet
• Output Template: Default Template
• File Content Strategy: Full file content
• Summary Prompt: Default Prompt
• Event Trigger: pull_request.opened

[hyperspace-insights]

The PR pins all reusable actions and workflows to a specific commit SHA instead of the mutable @main branch ref, which is a good security practice — but the same SHA 296573b55e906f5c77a1855bcfe4285cbbc5cac4 is applied to actions from two entirely separate repositories (cap-java/.github and cap-java/cds-feature-attachments). Since commit SHAs are repository-scoped, this SHA can only be valid in one repo's history, meaning the pins for at least one of the two repos are incorrect and will either resolve to the wrong commit or fail at runtime.

PR Bot Information

Version: 1.21.1

• Correlation ID: 2b85514d-75a9-490b-97fe-e1e873d76a39
• LLM: anthropic--claude-4.6-sonnet
• File Content Strategy: Full file content
• Agent Instructions:
  • CLAUDE.md
• Event Trigger: pull_request.opened