ci(action): harden header GitHub action

[domodwyer]

Hi there!

We use this very handy GitHub action in our public GitHub repo (thank you!) and until now we've had to add an exception for an unpinned actions/setup-go in our GitHub config to allow it to be used without a SHA pin.

We don't actually use this actions/setup-go action ourselves - it's purely part of the dependency tree because of the import in apache/skywalking-eyes/header. Given the recent supply chain attacks (1, 2) exploiting 3rd party actions, we're hoping to remove all allow-list exceptions and require SHA pins for everything, unblocking us to enable "require all actions to be pinned" on our repo.

This PR allows us (and likely others!) opt into this extra repo security by:

• Pinning the actions/setup-go usage to a specific SHA commit instead of a tag
• (additional extra, happy to drop) Hardens the inputs to prevent command injection

I realise actions/setup-go is an official action and unlikely to be compromised, but adding the SHA pin doesn't require any tradeoffs for the increased certainty / security.

---

• ci(action): pin actions/setup-go dependency (f7388a4)

  This commit switches the actions/setup-go dependency to use a commit
  hash pin instead of a (mutable) tag.
  
  This is considered best practice, and the official docs[1] state:
  
      Using the commit SHA of a released action version is the safest for stability and security.
  
  [1]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstepsuses
  

• ci(action): harden license-eye cmd arg inputs (46ef8e0)

  While these inputs are (likely) not attacker controlled, passing them
  via env vars ensures they are appropriately quoted / escaped.[1]
  
  This prevents command injection if a user of the action happens to be
  passing user-controlled inputs into the header action.
  
  [1]: https://docs.zizmor.sh/audits/#template-injection
  

[kezhenxu94]

Thank you!

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR hardens the header composite GitHub Action by removing a mutable tag reference in its action dependency tree and reducing the risk of untrusted input affecting the invoked CLI.

Changes:

• Pin actions/setup-go to a specific commit SHA instead of the v6 tag.
• Pass license-eye CLI arguments via environment variables instead of direct ${{ inputs.* }} interpolation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.