chore(ci): Pin GitHub Actions to immutable SHAs while preserving Dependabot tag tracking

[Copilot]

Description

Pin all GitHub Actions uses: references from floating major-version tags (e.g. @v6) to exact immutable commit SHAs, while keeping the tag visible as an inline comment (e.g. # v6).

This prevents unexpected behaviour if an upstream action project retargets a tag to a different commit. The inline tag comment also allows Dependabot (already configured for github-actions weekly updates) to detect new upstream releases and propose SHA bump PRs automatically.

Affected workflow files:

• .github/workflows/php.yml
• .github/workflows/php-dev.yml
• .github/workflows/release.yml

Actions pinned:

Action	Tag	SHA
actions/checkout	v6	de0fac2e4500dabe0009e67214ff5f5447ce83dd
shivammathur/setup-php	v2	accd6127cb78bee3e8082180cb391013d204ef9f
actions/cache	v5	27d5ce7f107fe9357f9df03efb73ab90386fccae
actions/upload-artifact	v6	b7c566a772e6b6bfb58ed0dc250532a479d7789f
actions/download-artifact	v7	37930b1c2abaa49bbe596cd826c3c89aef350131
codacy/codacy-coverage-reporter-action	v1	89d6c85cfafaec52c72b6c5e8b2878d33104c699
softprops/action-gh-release	v2	3bb12739c298aeb8a4eeaf626c5b8d85266b0e65

Resolves or fixes issue: none

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: GitHub Copilot (coding agent)
  • LLMs and versions: Claude Sonnet 4.5
  • Prompts: Pin all GitHub Actions uses references in workflow files to exact commit SHAs while preserving the tag as an inline comment so Dependabot can still detect and propose updates.

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage · +0.00% coverage variation

Metric	Results
Coverage variation	✅ +0.00% coverage variation
Diff coverage	✅ ∅ diff coverage (80.00%)

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (9377ecd)	1272	1197	94.10%
Head commit (baa1aa8)	1272 (+0)	1197 (+0)	94.10% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#631)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{TIP This summary will be updated as you push new changes. Give us feedback}