ci: fix the Security workflow (pin actions, dependabot cooldown, real security-check gate) (#279)

* chore(ci): pin GitHub Actions to commit SHAs across the monorepo

Pin every `uses:` reference to a full commit SHA (with a version comment
so Dependabot keeps them current) across the root workflows and all
packages/*/.github workflows. Resolves the semgrep
github-actions-mutable-action-tag findings.

Applied with pinact.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(ci): add a 7-day Dependabot cooldown to every update entry

Add `cooldown: { default-days: 7 }` to each ecosystem in every
dependabot.yml across the monorepo (and normalise the one pre-existing
cooldown to 7 days). Resolves the semgrep dependabot-missing-cooldown
findings and delays pulling freshly-published (possibly compromised)
releases.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(security-check): treat empty $guarded as a warning, not a failure

Backstage's 17 core models deliberately use `$guarded = []` because
writes go through validated Filament admin forms, not raw request mass
assignment. The security check flagged all of them as a high-severity
failure — a false positive relative to the architecture. Split the
mass-assignment check so empty $guarded is a medium warning while
sensitive fields in $fillable remain a hard failure.

Add a Pest test asserting `backstage:security-check --package-only`
exits 0, and record the decision in ADR-0003.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(ci): pin actions pinact could not auto-resolve, add pinact config

Three pint.yml refs pointed at non-existent tags (laravel-pint-action
@latest / @2.4.0, git-auto-commit-action @v5.0) that pinact could not
resolve; pin them to valid release SHAs by hand. Add .pinact.yaml so
both the one-shot pin and the CI guard cover packages/*/.github
workflows, not just the root.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci(security): gate on the security check, add an action-pinning guard

The Backstage Security Check job never actually ran: this is a package
repo with no `artisan` binary, and it passed a non-existent `--ci`
flag, all masked by continue-on-error. Run it through the test harness
instead (a Pest test that boots the full provider stack), mirroring the
run-tests MySQL service + extensions + DB env, and drop
continue-on-error so it genuinely gates CI.

Add an Action Pinning job (pinact-action, fix disabled) that fails when
any workflow reintroduces an unpinned action.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Casmo

.github/workflows/run-tests.yml

@@ -34,10 +34,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ matrix.php }}
           extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick, fileinfo

.github/workflows/update-changelog.yml

@@ -14,18 +14,18 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           ref: main
 
       - name: Update Changelog
-        uses: stefanzweifel/changelog-updater-action@v1
+        uses: stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1.12.0
         with:
           latest-version: ${{ github.event.release.name }}
           release-notes: ${{ github.event.release.body }}
 
       - name: Commit updated CHANGELOG
-        uses: stefanzweifel/git-auto-commit-action@v7
+        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
         with:
           branch: main
           commit_message: Update CHANGELOG