chore: pin GitHub Actions to commit SHAs

[BGos87]

Summary

Pin every uses: ref in .github/workflows/ (and any composite action
files) to a full 40-character commit SHA, with the original tag
preserved as a # vX comment.

Why

Tags and branches are mutable, so a compromised action can replace what
runs in our pipelines without changing the tag we reference. Pinning to
a SHA closes that supply-chain vector. See GitHub's hardening guide:
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions.

Deadline

TechOps is enforcing SHA-pinned GitHub Actions across the org by
June 8, 2026. Merging this PR brings the repo into compliance ahead
of the cut-over; after that date workflows that still reference
mutable tags or branches will be blocked from running.

How

Generated mechanically with pinact run.
No version bumps were applied (strict pin); follow-up upgrades can come
from Renovate or a separate pinact run -u PR.

Test plan

• CI green on this branch

---

Note

Low Risk
Low risk workflow-only change that pins a third-party GitHub Action to an immutable SHA; no behavior changes expected beyond supply-chain hardening.

Overview
Pins gaurav-nelson/github-action-markdown-link-check from the mutable @v1 ref to a specific commit SHA in both the weekly (check-links-nightly.yml) and PR (check-links.yml) link-check workflows, preserving the original version as a # v1 comment.

^{Reviewed by Cursor Bugbot for commit b302d94. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b302d94. Configure here.}

[cursor]

actions/checkout@master left unpinned in both workflows

High Severity

This PR's stated goal is to "Pin every uses: ref" to a commit SHA, but actions/checkout@master remains unpinned in both workflow files. Referencing @master is a mutable branch ref — even riskier than the mutable tag refs this PR fixes — and leaves the same supply-chain attack vector open that the PR claims to close. The TechOps compliance deadline will not be met for these workflows.

Additional Locations (1)

• .github/workflows/check-links.yml#L8-L9

 

^{Reviewed by Cursor Bugbot for commit b302d94. Configure here.}