[Salil Das (sadlilas)]

Change

Pin 168 external GitHub Actions references across 18 workflows to full commit SHAs for their existing version tags. The canonical owner is .github/workflows/. Original tags remain as comments; action subdirectories and all seven local reusable-workflow calls are unchanged. No action major-version upgrades or application changes.

Align 25 literal action expectations in five workflow contract test files with those exact SHAs. All existing assertions, artifact/readiness contracts and test coverage remain; arbitrary SHAs are not normalized or accepted.

Validation

Workflow base: 922270fe351e3681e7ba0e926b0e10254de42b8c. Follow-up tested source: the five-test-file working-tree diff against pinned commit 36127821887d8000a4e3565595e5918c7f4e84c5; all workflow bytes remain unchanged from that commit.

• PASS: all 18 workflows parse with the on key preserved and match the baseline after normalizing only the expected action pins.
• PASS: exact line-only guards, including three rejected negative controls; zero mutable external action references remain.
• PASS: actionlint 1.7.12 on every baseline and current workflow; all exit codes are 0 with exactly matching empty output. Optional ShellCheck/Pyflakes analyses were NOT RUN because those executables were unavailable.
• PASS: git diff --check.
• PASS: independent isolated Linux configuration validation and a separate rerun, including source hashes, actionlint, exact workflow semantics, pin mappings, and negative controls.
• PASS: local Python 3.13 focused source/unit checks, 123 passed, including all 17 affected workflow contract tests. Before alignment, those 17 produced 16 failures and one vacuous pass; afterward all 17 pass. Counts overlap.
• PASS: six in-memory wrong-SHA negative controls reject; all five changed test files compile; zero mutable-action tag expectations remain in tracked repository text.
• CI follow-up: Fast release checks and client performance exposed the literal-tag regressions addressed here. Full Linux/CI reruns of the test alignment are pending.
• Separate limitation: native integration failed before tests on conflicting Git dependency requirements. Dependency inputs are unchanged by this PR; baseline execution was not reproduced and this is not fixed here.
• NOT RUN locally: full application, live browser, installed/runtime and build suites. Focused checks are not an all-CI-green or application qualification claim.
• N/A: installed/live behavior and performance qualification; no application behavior or workload changes.