[RomFloreani]

DEVOPS-1133 - pin all GitHub actions and reusable workflows to hash
Expands moving GitHub Actions tags to the full semver tag pointing at the same commit, then pins every uses: to a commit hash with a dependabot-readable version comment.

Tags expanded in this repo:

• MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3 -> @v3.12.0

Workflows added:

• .github/workflows/dependabot-auto-merge.yml
• .github/workflows/wip-status.yml

All MiraGeoscience/CI-tools reusable workflows are pinned to 7241532854727d993872b67fc761139b8438615b (v3.12.0).

[Copilot]

🟡 Changes recommended

The newly added dependabot auto-merge workflow is not restricted to Dependabot PRs, which could allow unintended auto-merge behavior on regular pull requests.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Pins MiraGeoscience/CI-tools reusable workflows to immutable commit SHAs to improve supply-chain security and reproducibility of CI behavior.

Changes:

• Updated multiple existing workflows to use commit-SHA pins for CI-tools reusable workflows (annotated with the corresponding CI-tools version).
• Added a new workflow to run CI-tools “Dependabot auto-merge” reusable workflow.

File summaries

File	Description
.github/workflows/security_scan.yml	Pins zizmor reusable workflow references to a specific CI-tools commit SHA.
.github/workflows/python_deploy_prod.yml	Pins production release reusable workflows (conda/pypi) to a specific CI-tools commit SHA.
.github/workflows/python_deploy_dev.yml	Pins development publish reusable workflows (conda/pypi) to a specific CI-tools commit SHA.
.github/workflows/pr_jira_actions.yml	Pins JIRA PR actions reusable workflow to a specific CI-tools commit SHA.
.github/workflows/issue_to_jira.yml	Pins issue-to-JIRA reusable workflow to a specific CI-tools commit SHA.
.github/workflows/dependabot-auto-merge.yml	Introduces a new Dependabot auto-merge workflow calling a pinned CI-tools reusable workflow.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

⚠️ Force push detected - Previous Copilot review comments may no longer be relevant to the current code. Please resolve any outdated threads and re-request a Copilot review when ready.

[github-actions]

⚠️ Force push detected - Previous Copilot review comments may no longer be relevant to the current code. Please resolve any outdated threads and re-request a Copilot review when ready.