Pin Third-Party Actions to Immutable Commit SHAs and Eliminate Workflow Expression Injection

[mertcano]

Description

This pull request addresses high- and medium-severity CI/CD supply chain and script execution vulnerabilities identified in shared-workflows during the workspace-wide security audit (FM-07, FM-08).

Because workflows in this repository are designed for reusable consumption (workflow_call) across all organization repositories, referencing mutable action tags presented an organization-wide supply-chain risk. Additionally, inline expression evaluation inside shell run blocks opened potential script-injection vectors. This PR pins external actions to verified commit SHAs and enforces environment variable indirection for workflow parameters.

Key Changes & Remediations

1. Immutable Action Pinning (FM-07 - ci.yml, dependency-cooldown.yml, dependency-cooldown-audit.yml)

• Digest Pinning: Replaced mutable @v7 action tags with full 40-character commit digests verified via the GitHub REST API:
  • actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 (# v7)
  • actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 (# v7)
• Supply Chain Boundary: Prevents upstream tag hijacking or unreviewed mutations from injecting untrusted steps into downstream CI pipelines across the organization.

2. Safe Expression Handling (FM-08 - dependency-cooldown.yml)

• Environment Indirection: In the Reject unsupported events step, eliminated inline ${{ github.event_name }} interpolation from the bash script body.
• Shell Variable Expansion: Passed the context value through env: EVENT_NAME: ${{ github.event_name }} and referenced it as $EVENT_NAME within the command line.

How to Review

1. Inspect .github/workflows/ files (ci.yml, dependency-cooldown.yml, dependency-cooldown-audit.yml) to confirm that all actions/checkout and actions/setup-node invocations reference full commit digests.
2. Verify in dependency-cooldown.yml that no ${{ ... }} expressions remain inside the run: execution block.