chore: dev to main merge

[Saswato-Microsoft]

Purpose

This pull request primarily updates GitHub Actions workflows to use pinned action versions by commit SHA instead of floating tags, improving security and reproducibility. Additionally, it adds a preprovision deployment notice to azure.yaml to guide users in case of deployment issues.

Workflow action pinning and security improvements:

• Updated all workflow steps in .github/workflows to use specific commit SHAs for actions such as actions/checkout, microsoft/template-validation-action, Azure/setup-azd, azure/login, lycheeverse/lychee-action, codfish/semantic-release-action, amannn/action-semantic-pull-request, and actions/stale, replacing floating tags with pinned versions for better security and reliability. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]

User experience and deployment guidance:

• Added a preprovision PowerShell step in azure.yaml to display a deployment notice, advising users to open an issue with logs if deployment fails, and providing a direct link to the issue tracker.

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Pull request overview

This PR improves CI/CD supply-chain security and reproducibility by pinning GitHub Actions workflow dependencies to immutable references (commit SHAs / digests) and adds a pre-deployment notice to azure.yaml to guide users toward filing issues with logs when deployments fail.

Changes:

• Pin multiple GitHub Actions uses: references from floating tags (e.g., @vX, @Latest) to commit SHAs/digests across workflows.
• Add a preprovision PowerShell hook in azure.yaml to display a deployment support notice and issue link.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
azure.yaml	Adds a preprovision hook that prints a deployment-failure notice and issue tracker link.
.github/workflows/stale-bot.yml	Pins actions/stale to a specific commit SHA.
.github/workflows/pr-title-checker.yml	Pins amannn/action-semantic-pull-request to a specific commit SHA.
.github/workflows/create-release.yml	Pins checkout and switches semantic-release step to an immutable reference (but current form likely breaks inputs).
.github/workflows/broken-links-checker.yml	Pins actions/checkout and lycheeverse/lychee-action to specific commit SHAs.
.github/workflows/azure-dev.yml	Pins actions/checkout, Azure/setup-azd, and azure/login to specific commit SHAs.
.github/workflows/azd-template-validation.yml	Pins actions/checkout and microsoft/template-validation-action to specific commit SHA.

Suppressed comments (1)

.github/workflows/create-release.yml:25

• This step uses uses: docker://ghcr.io/codfish/semantic-release-action@sha256:... but also supplies action-style inputs (with: tag-format, additional-packages, plugins). For docker:// actions, those inputs are not recognized unless the action metadata is available, so this is likely to break the release job. Prefer pinning the GitHub Action itself by commit SHA (e.g., codfish/semantic-release-action@<sha>) or switch to passing container args in the supported with: args form for docker:// steps.

      - uses: docker://ghcr.io/codfish/semantic-release-action@sha256:c6a4e05d93f73f2870887434c1286df7a23a55770be16cb826b6e2432f92e650 # v5.0.0
        id: semantic
        with:
          tag-format: "v${version}"
          additional-packages: |

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.