chore: pin GitHub Actions to commit SHAs

[tungvuson]

Why

N/A — automated security hardening (supply-chain security)

Summary

Pin all GitHub Actions uses: references to exact commit SHAs. Reusable workflow calls and local ./ refs are left unchanged.

Changes proposed in this pull request

• .github/**/*.yml / .github/**/*.yaml — each uses: action@tag replaced with uses: action@<commit-sha> # tag

Test Evidence

No logic changes. SHA values verified against GitHub API at time of generation.

Risk

Size: small diff (YAML comments only). Complexity: none. Type: CI config. Feature area: none. Requirements adherence: N/A. Test evidence clarity: N/A. Overall: no risk identified.

[Copilot]

Pull request overview

This PR hardens the repository’s GitHub Actions supply chain by pinning third-party uses: references in workflows to immutable commit SHAs (while retaining the original version tag in a comment for readability).

Changes:

• Pin actions/stale in the stale-issue workflow to a specific commit SHA.
• Pin release automation (release-please) to a specific commit SHA.
• Pin CI and publishing workflows’ external actions (checkout, helm tooling, conventional-commit check, gh-pages deploy) to specific commit SHAs.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/stale.yaml	Pins actions/stale to a commit SHA for immutable execution.
.github/workflows/release.yaml	Pins google-github-actions/release-please-action to a commit SHA.
.github/workflows/push.yaml	Pins checkout, helm3, and gh-pages deploy actions to commit SHAs in the chart publish workflow.
.github/workflows/lint-test.yaml	Pins checkout, helm setup, python setup, chart-testing, and kind actions to commit SHAs.
.github/workflows/conventional-commits-check.yaml	Pins checkout and conventional-commits validation action to commit SHAs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.