[RomFloreani]

DEVOPS-1133 - pin all GitHub actions and reusable workflows to hash
Expands moving GitHub Actions tags to the full semver tag pointing at the same commit, then pins every uses: to a commit hash with a dependabot-readable version comment.

Tags expanded in this repo:

• MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3.7.0-alpha.1 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3.7.0-alpha.1 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3 -> @v3.12.0

Workflows added:

• .github/workflows/dependabot-auto-merge.yml
• .github/workflows/wip-status.yml

All MiraGeoscience/CI-tools reusable workflows are pinned to 7241532854727d993872b67fc761139b8438615b (v3.12.0).

[Copilot]

🟡 Changes recommended

The new Dependabot auto-merge workflow grants write permissions on all PRs without an explicit Dependabot-only gate, which is a security risk.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Pins MiraGeoscience/CI-tools reusable workflow references to immutable commit SHAs to satisfy DEVOPS-1133 (“pin all GitHub actions and reusable workflows to hash”), and adds an auto-merge workflow for Dependabot PRs.

Changes:

• Updated multiple existing workflows to use a fixed CI-tools commit SHA (with version comments) instead of @v3 / prerelease tags.
• Added a new dependabot-auto-merge workflow that calls the CI-tools reusable workflow pinned to a SHA.

File summaries

File	Description
.github/workflows/security_scan.yml	Pins Zizmor reusable workflows to a CI-tools commit SHA.
.github/workflows/python_deploy_prod.yml	Pins production release reusable workflows to a CI-tools commit SHA.
.github/workflows/python_deploy_dev.yml	Pins development publish reusable workflows to a CI-tools commit SHA.
.github/workflows/pr_jira_actions.yml	Pins JIRA PR actions reusable workflow to a CI-tools commit SHA.
.github/workflows/issue_to_jira.yml	Pins JIRA issue creation reusable workflow to a CI-tools commit SHA.
.github/workflows/dependabot-auto-merge.yml	Introduces Dependabot auto-merge via a pinned CI-tools reusable workflow.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

⚠️ Force push detected - Previous Copilot review comments may no longer be relevant to the current code. Please resolve any outdated threads and re-request a Copilot review when ready.

[github-actions]

⚠️ Force push detected - Previous Copilot review comments may no longer be relevant to the current code. Please resolve any outdated threads and re-request a Copilot review when ready.