fix: pin 7 unpinned action(s), extract 3 unsafe expression(s) to env vars

[dagecko]

Summary

This PR hardens your CI/CD workflows against supply chain attacks by pinning GitHub Actions to immutable commit SHAs and extracting unsafe expressions from run: blocks into env: mappings.

A note on pinning internal/org-owned actions: Some of the actions pinned in this PR are ones you maintain. The reason we pin these as well is that the tj-actions compromise in March 2025 and the Trivy compromise in March 2026 both worked by compromising a maintainer account and pushing malicious code to mutable tags that the organization controlled. Scoped permissions on a workflow reduce the blast radius but do not prevent the compromise - a compromised maintainer account can modify the action code itself, which then executes in every downstream workflow regardless of that workflow's permission settings. SHA pinning is the only mechanism that prevents a force-pushed tag from changing what your workflow executes.

Fixes applied (in this PR)

Rule	Severity	File	Description
RGS-007	medium	automerge-dependabot.yml	Pinned 1 action(s) to commit SHA
RGS-007	medium	ci.yml	Pinned 4 action(s) to commit SHA
RGS-007	medium	cpr-example-command.yml	Pinned 1 action(s) to commit SHA
RGS-007	medium	slash-command-dispatch.yml	Pinned 1 action(s) to commit SHA
RGS-008	high	update-major-version.yml	Extracted 3 expression(s) to env vars

Advisory: additional findings (manual review recommended)

Rule	Severity	File	Description
RGS-004	high	slash-command-dispatch.yml	Comment-Triggered Workflow Without Author Authorization Check
RGS-018	high	update-major-version.yml	Suspicious Payload Execution Pattern
RGS-019	medium	cpr-example-command.yml	Step Output Interpolated in run Block

Why this PR

I've been scanning the top 50,000 GitHub repositories for CI/CD pipeline vulnerabilities over the last 5 weeks as part of an ongoing research effort into the supply chain attack campaign that started with tj-actions in March and has escalated through multiple phases since, where attackers compromise maintainer accounts and force-push malicious code to mutable action tags - every downstream project referencing those tags then executes the attacker's code with full access to secrets and deployment credentials.

You may notice that I have opened up a lot of PRs - don't take that as a negative. I've been working around the clock on this and monitoring all comms. It may take me an hour or two to get back to a comment you leave.

How to verify

Every change is mechanical and preserves workflow behavior:

• SHA pinning: action@v3 becomes action@abc123 # v3 - original version preserved as comment
• Expression extraction: ${{ expr }} in run: moves to env: block, referenced as "${ENV_VAR}" in the script
• No workflow logic, triggers, or permissions are modified

I've had 22 merges so far. I created a tool called Runner Guard to assist in my research - it does mechanical, non-AI fixes to reduce hallucinations to zero and produce consistent fixes. If you would like to scan it yourself to validate my work, feel free.

Happy to answer any questions - I'm monitoring comms on every PR.

- Chris Nyhuis (dagecko)