[Copilot]

• Inspect workflows, local action manifests, existing Dependabot policies, and CI status; no local action manifests or reusable workflows found.
• Resolve current upstream action refs using git ls-remote and GitHub commit API; retain the existing nrwl/nx-set-shas pin matching dereferenced v4.4.0.
• Pin 13 mutable executable references across three workflows with original-ref comments; preserve existing pins and the already-valid weekly root Dependabot github-actions entry and npm policies unchanged.
• Validate workflow YAML with PyYAML, confirm semantic equality except uses pins, pass Dependabot JSON Schema validation using SchemaStore's upstream GitHub schema, pass git diff --check, and scan changed files for secrets (none found).
• Commit focused changes, run CodeQL, and document final check results and limitations: actionlint and repository Node dependencies are unavailable; SchemaStore hostname failed, but upstream GitHub schema validation passed; current PR CI requires approval (action_required, zero jobs/logs). Existing commented-out upload-artifact@v6 example is non-executable and intentionally unchanged; no executable exceptions or unresolved refs.

Original prompt

Title: chore(ci): pin GitHub Actions to commit SHAs and configure Dependabot

Implement SHA pinning of GitHub Actions and automated maintenance through Dependabot in this repository. Work entirely in Copilot cloud and open one focused pull request against the default branch. Do not merge it.

Follow repository contributor and Copilot instructions. Inspect existing workflows, local composite actions, and Dependabot configuration before editing.

Pin every external GitHub action and external reusable workflow reference in executable workflow/action YAML to a verified full 40-character commit SHA, with a readable version/ref comment (for example, # v4.2.2). Cover .github/workflows and local composite action manifests wherever they live; retain already-correct pins. Resolve the CURRENT referenced release/tag/ref to its actual commit in the upstream repository, dereferencing annotated tags. Do not guess hashes or upgrade action versions/major versions as part of this task. Keep distinct versions distinct where intentionally used. Leave local ./ action/workflow references unchanged; do not treat docker:// references as Git commit references. If any mutable reference cannot be resolved, explicitly report it rather than silently skipping it or inventing a replacement.

Create or minimally extend .github/dependabot.yml (or the existing .yaml equivalent) with version: 2 and a github-actions updates entry for directory / on a weekly schedule. Preserve existing ecosystem entries, grouping, schedules, labels, and other intentional policies; reuse a valid existing github-actions entry rather than duplicating it. Ensure configuration supports Dependabot maintaining SHA-pinned action references and readable version comments.

Preserve workflow behavior, triggers, permissions, inputs, runner choices, secrets, and deployment/release semantics. No unrelated dependency upgrades, automatic merging, or repository/organization settings changes.

Validate YAML and Dependabot configuration using available repository tooling, verify upstream commit identities, and scan the relevant executable YAML to confirm no external GitHub uses references remain unpinned, explicitly documenting any legitimate exceptions. Run the narrow applicable checks and include results and limitations in the PR description. Do not claim checks passed if unavailable or failing.