chore(ci): pin GitHub Actions to full commit SHAs

[gkorland]

Summary

Pins every GitHub Actions uses: reference in this repository's workflows to a full 40-character commit SHA instead of a mutable tag or branch.

Mutable refs (@v4, @main, @stable, …) are re-pointable by the action owner or an attacker who compromises the action repo. Because these workflows run with repository secrets and write permissions, a moved tag is a direct supply-chain code-execution path. GitHub's own hardening guide and OpenSSF Scorecard both require full-SHA pinning.

Changes

• Pinned 6 action reference(s) across 2 workflow file(s).
• Each SHA is the commit the original tag/branch resolved to at the time of this PR, so behaviour is unchanged.
• The original version is preserved as a trailing comment for readability and for Dependabot, e.g.

  uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

Workflow files touched:

• export-metrics.yml
• push-to-hubspot.yml

Resulting pinned references:

• actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
• actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
• actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
• actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4

Follow-up recommendation: this repo has no .github/dependabot.yml. Adding the github-actions ecosystem there keeps SHA pins updated automatically (Dependabot rewrites the SHA and the trailing version comment), so pinning does not mean going stale. Not included in this PR.

Testing

• All modified workflow files were validated as parseable YAML.
• The diff is strictly 1-line-in / 1-line-out on uses: lines only — no jobs, steps, triggers, inputs, permissions or action versions were changed (verified via git diff --shortstat).
• Every SHA was resolved through the GitHub API (GET /repos/{owner}/{repo}/commits/{ref}) from the exact ref previously in use; no ref failed to resolve.
• Final verification is the CI run on this PR.

Memory / Performance Impact

N/A — CI configuration only.

Related Issues

N/A — part of an org-wide GitHub Actions supply-chain hardening pass across the FalkorDB organisation.

Summary by CodeRabbit

• Chores
  • Updated automated workflows to use immutable versions of their build and artifact management actions.
  • Improved workflow security and reliability without changing end-user functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 02f47591-95eb-47d3-8501-0f735bf3c5e8

📥 Commits

Reviewing files that changed from the base of the PR and between c9781e7 and c4f0c55.

📒 Files selected for processing (2)

• .github/workflows/export-metrics.yml
• .github/workflows/push-to-hubspot.yml

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The two GitHub Actions workflows now pin checkout, Python setup, and artifact actions to specific commit SHAs instead of floating v4 references.

Changes

Workflow action pinning

Layer / File(s)	Summary
Pin workflow actions .github/workflows/export-metrics.yml, .github/workflows/push-to-hubspot.yml	Both workflows use commit SHAs for checkout and Python setup. The workflows also pin their artifact upload or download actions.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to c4f0c

This change only pins existing workflow actions to immutable commit SHAs without changing workflow behavior, permissions, inputs, or triggers. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes pinning GitHub Actions to full commit SHAs, which is the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/pin-actions-to-sha

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR hardens the repository’s CI supply chain by pinning GitHub Actions uses: references in the workflows to immutable 40-character commit SHAs, reducing the risk of tag/branch retargeting.

Changes:

• Replaced mutable action refs (e.g., @v4, @v5) with full commit SHAs in the two existing workflow files.
• Preserved the original version identifiers as trailing comments (e.g., # v4, # v5) for readability and tooling compatibility.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/push-to-hubspot.yml	Pins checkout, setup-python, and download-artifact actions to full commit SHAs.
.github/workflows/export-metrics.yml	Pins checkout, setup-python, and upload-artifact actions to full commit SHAs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.