ci: fix the Security workflow (pin actions, dependabot cooldown, real security-check gate) (#279)

* chore(ci): pin GitHub Actions to commit SHAs across the monorepo

Pin every `uses:` reference to a full commit SHA (with a version comment
so Dependabot keeps them current) across the root workflows and all
packages/*/.github workflows. Resolves the semgrep
github-actions-mutable-action-tag findings.

Applied with pinact.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(ci): add a 7-day Dependabot cooldown to every update entry

Add `cooldown: { default-days: 7 }` to each ecosystem in every
dependabot.yml across the monorepo (and normalise the one pre-existing
cooldown to 7 days). Resolves the semgrep dependabot-missing-cooldown
findings and delays pulling freshly-published (possibly compromised)
releases.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(security-check): treat empty $guarded as a warning, not a failure

Backstage's 17 core models deliberately use `$guarded = []` because
writes go through validated Filament admin forms, not raw request mass
assignment. The security check flagged all of them as a high-severity
failure — a false positive relative to the architecture. Split the
mass-assignment check so empty $guarded is a medium warning while
sensitive fields in $fillable remain a hard failure.

Add a Pest test asserting `backstage:security-check --package-only`
exits 0, and record the decision in ADR-0003.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(ci): pin actions pinact could not auto-resolve, add pinact config

Three pint.yml refs pointed at non-existent tags (laravel-pint-action
@latest / @2.4.0, git-auto-commit-action @v5.0) that pinact could not
resolve; pin them to valid release SHAs by hand. Add .pinact.yaml so
both the one-shot pin and the CI guard cover packages/*/.github
workflows, not just the root.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci(security): gate on the security check, add an action-pinning guard

The Backstage Security Check job never actually ran: this is a package
repo with no `artisan` binary, and it passed a non-existent `--ci`
flag, all masked by continue-on-error. Run it through the test harness
instead (a Pest test that boots the full provider stack), mirroring the
run-tests MySQL service + extensions + DB env, and drop
continue-on-error so it genuinely gates CI.

Add an Action Pinning job (pinact-action, fix disabled) that fails when
any workflow reintroduces an unpinned action.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Casmo

.github/dependabot.yml

@@ -5,13 +5,17 @@ version: 2
 updates:
 
   - package-ecosystem: "github-actions"
+    cooldown:
+      default-days: 7
     directory: "/"
     schedule:
       interval: "weekly"
     labels:
       - "dependencies"
 
   - package-ecosystem: "composer"
+    cooldown:
+      default-days: 7
     directory: "/"
     schedule:
       interval: "weekly"

.github/workflows/dependabot-auto-merge.yml

@@ -14,7 +14,7 @@ jobs:
 
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2.4.0
+        uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2.4.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 

.github/workflows/fix-php-code-style-issues.yml

@@ -15,14 +15,14 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.head_ref }}
 
       - name: Fix PHP code style issues
-        uses: aglipanci/laravel-pint-action@2.6
+        uses: aglipanci/laravel-pint-action@36de00d5f5a8a4e12d443e01671daa12a18f4c79 # 2.6
 
       - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
         with:
           commit_message: Fix styling

.github/workflows/phpstan.yml

@@ -13,16 +13,16 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           coverage: none
 
       - name: Install composer dependencies
-        uses: ramsey/composer-install@v3
+        uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f # 3.2.1
 
       - name: Run PHPStan
         run: ./vendor/bin/phpstan --error-format=github

.github/workflows/run-tests.yml

@@ -32,10 +32,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ matrix.php }}
           extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick, fileinfo

.github/workflows/update-changelog.yml

@@ -14,18 +14,18 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: main
 
       - name: Update Changelog
-        uses: stefanzweifel/changelog-updater-action@v1
+        uses: stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1.12.0
         with:
           latest-version: ${{ github.event.release.name }}
           release-notes: ${{ github.event.release.body }}
 
       - name: Commit updated CHANGELOG
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
         with:
           branch: main
           commit_message: Update CHANGELOG