ci: enforce one SHA per action across workflows + composites (maturity L2)

[BigSimmo]

Summary

Phase 3 of the maturity backlog (docs/maturity-backlog-workorders.md → L2): eliminate action-version skew and make it non-regressable.

• Aligned the laggards to the majority (v7.0.0): actions/checkout v6.0.3 → v7.0.0 in 5 workflows (ci-triage, ingestion-autopilot, staging-tenancy, dependency-report, ops-digest), and actions/setup-node v5.0.0 → v7.0.0 in the setup-node-cached composite. Every action is now on a single SHA (checkout 24×, setup-node 8×, all others already uniform).
• Enforced it: extended scripts/check-github-action-pins.mjs to assert one SHA per action across workflows and composite actions. The checker previously scanned only .github/workflows/**, which is exactly why the setup-node composite skew was invisible.
• Marked L2 done in the work-order tracker.

The setup-node-cached composite uses only stable inputs (node-version-file, cache, cache-dependency-path) — all supported in v7 — and v7.0.0 is already the proven majority across CI, so there's no behavioural change.

Verification

• npm run check:github-actions — pass (alignment satisfies the new assertion).
• Negative test — reintroducing a checkout@v6.0.3 skew makes the checker fail with a precise message listing every location; reverting restores green. (Proven locally.)
• npm run format:check — pass. npm run docs:check-links — pass (989 refs).
• No dependency or source-behaviour change.

Risk and rollout

• Risk: low. Version bumps land the laggards on the same pin the rest of CI already runs; the checker change is a pure additive guard verified to fire correctly.
• Rollback: revert the PR.
• Provider or production effects: None.

Clinical Governance Preflight

N/A — CI configuration only; no ingestion, answer generation, search/ranking, source rendering, document access, privacy, production-env, or clinical-output behaviour changed.

Notes

Complements Phase 1 (#985, merged — Dependabot grouping already batches action bumps) and Phase 2 (#986 — import-boundary linter + dependency report). Remaining backlog items (src/lib/rag extraction, monolith decomposition, SAST-blocking, ACL consolidation, coverage floors, L3/L4) stay as tracked work orders.

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Updated repository automation actions to newer pinned revisions for Node setup and repository checkout across CI workflows.
• Documentation
  • Updated the maturity backlog to mark action-SHA uniformity as complete.
• Tests
  • Expanded automated verification to ensure the same third-party action name is pinned to a single commit SHA across both workflows and composite actions, failing when mismatches are detected.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b20a976c-b0c5-4403-8629-6c4b1a12751d

📥 Commits

Reviewing files that changed from the base of the PR and between 9ff524b and f88abd5.

📒 Files selected for processing (1)

• .github/workflows/dependency-report.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/dependency-report.yml

---

📝 Walkthrough

Walkthrough

The PR extends GitHub Action pin validation to composite actions, updates several action references to newer pinned commits, and marks the related maturity backlog item complete.

Changes

GitHub Action pin uniformity

Layer / File(s)	Summary
Composite action pin validation scripts/check-github-action-pins.mjs	The checker discovers composite manifests, parses pinned action SHAs, and reports inconsistent SHAs for the same action.
Pinned action revision updates .github/actions/setup-node-cached/action.yml, .github/workflows/*.yml	The setup-node composite action and six workflows use newer v7.0.0 pinned revisions.
Backlog status documentation docs/maturity-backlog-workorders.md	The L2 action-SHA uniformity item and progress summary are updated to DONE.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• BigSimmo/Database#452: Both PRs modify the GitHub Action pin-checking flow.
• BigSimmo/Database#472: Both PRs extend validation in scripts/check-github-action-pins.mjs.
• BigSimmo/Database#687: Both PRs strengthen GitHub Actions pin consistency validation.

Suggested labels: github_actions

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: enforcing one SHA per GitHub Action across workflows and composites.
Description check	✅ Passed	The description covers summary, verification, risk, governance, and notes, and is mostly complete despite not using the exact template checklist format.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/maturity-phase-3-action-sha-uniformity

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/dependency-report.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/check-github-action-pins.mjs`:
- Around line 100-112: The composite-action scan around
discoverCompositeActionFiles must validate every matched action reference, not
only record 40-hex SHA matches. Reuse validateActionReference as in the
workflow-processing path so references such as vendor/action@v1 are rejected,
while preserving the existing SHA grouping and location tracking for valid pins.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1aa26576-3616-47c2-8916-b981ef5159cc

📥 Commits

Reviewing files that changed from the base of the PR and between b63ead1 and 2c30c78.

📒 Files selected for processing (8)

• .github/actions/setup-node-cached/action.yml
• .github/workflows/ci-triage.yml
• .github/workflows/dependency-report.yml
• .github/workflows/ingestion-autopilot.yml
• .github/workflows/ops-digest.yml
• .github/workflows/staging-tenancy.yml
• docs/maturity-backlog-workorders.md
• scripts/check-github-action-pins.mjs