Pin GH Actions to commit sha

[votdev]

Related to: harvester/harvester#10279

[Copilot]

Pull request overview

This PR strengthens the repository’s GitHub Actions supply-chain security posture by pinning third-party Actions to immutable commit SHAs (instead of floating tags/branches), in line with the goal in harvester/harvester#10279.

Changes:

• Pin actions/checkout, Docker setup/login/build actions, and read-vault-secrets to commit SHAs in the reusable build workflow.
• Pin Trivy scan and SARIF upload actions to commit SHAs in the Trivy scanning workflow.
• Pin FOSSA and CodeQL-related actions to commit SHAs in their respective workflows.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/template-build.yml	Pins build/publish workflow action dependencies (checkout, docker actions, vault secret reader) to commit SHAs.
.github/workflows/scan.yml	Pins Trivy scanning and SARIF upload actions (and checkout) to commit SHAs.
.github/workflows/fossa.yml	Pins vault secret reader and FOSSA action to commit SHAs.
.github/workflows/codeql-analysis.yml	Pins checkout and CodeQL actions (init/autobuild/analyze) to commit SHAs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[martindekov]

LGTM!

[Vicente-Cheng]

@Mergifyio backport v1.7

[mergify]

backport v1.7

✅ Backports have been created

Details

• #151 Pin GH Actions to commit sha (backport #146) has been created for branch v1.7 but encountered conflicts

Cherry-pick of 0658443 has failed:

On branch mergify/bp/v1.7/pr-146
Your branch is up to date with 'origin/v1.7'.

You are currently cherry-picking commit 0658443.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   .github/workflows/codeql-analysis.yml
	modified:   .github/workflows/scan.yml
	modified:   .github/workflows/template-build.yml

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	deleted by us:   .github/workflows/fossa.yml

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally