ci: pin third-party GitHub Actions to verified release SHAs

[Vamshi-Microsoft]

Purpose

Harden CI/CD against supply-chain attacks by pinning third-party actions to verified release commit SHAs.

• Replace tj-actions/changed-files in broken-links-checker.yml with a built-in git diff step. The new step detects changed markdown files between the PR base and head SHAs and preserves the any_changed / all_changed_files outputs consumed by the lychee step — zero third-party dependency.
• Pin third-party actions to their latest verified release SHAs (mutable tags can be silently repointed to malicious code):
  • lycheeverse/lychee-action → 8646ba3 (v2.8.0)
  • amannn/action-semantic-pull-request → 48f2562 (v6.1.1)
  • MishaKav/pytest-coverage-comment → e48ae95 (v1.8.0)

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone https://github.com/microsoft/customer-chatbot-solution-accelerator
cd customer-chatbot-solution-accelerator
git checkout ci/pin-actions-and-git-diff

• Test the code

# Open a PR that adds/modifies a markdown file containing a broken relative link.
# The "Broken Link Checker" workflow should:
#   - detect the changed markdown file via the new git diff step (all_changed_files)
#   - fail on the broken link, pass when the link is valid

(Validated on a throwaway PR: the git-diff step listed the changed file and lychee failed only on the broken link, exit code 2.)

What to Check

Verify that the following are valid

• No workflow references tj-actions/changed-files.
• Every third-party action uses a full commit SHA with a trailing version comment.
• Pinned SHAs resolve to the latest release tags (v2.8.0 / v6.1.1 / v1.8.0).
• Affected jobs retain least-privilege permissions: (pull-requests: read for pr-title-checker, pull-requests: write for tests).
• Broken-link checker still detects changed markdown and fails on broken links.

Other Information

Changed files:

• .github/workflows/broken-links-checker.yml
• .github/workflows/pr-title-checker.yml
• .github/workflows/tests.yaml

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	2400	258	89%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
402	0 💤	0 ❌	0 🔥	9.584s ⏱️

[Copilot]

Pull request overview

This PR hardens the repository’s GitHub Actions workflows by removing a previously compromised third-party action, switching to a built-in git diff approach for changed Markdown detection, and pinning third-party actions to immutable commit SHAs to reduce supply-chain risk.

Changes:

• Replaced tj-actions/changed-files with a git diff step that emits compatible any_changed / all_changed_files outputs for the lychee broken-link check.
• Pinned lycheeverse/lychee-action, amannn/action-semantic-pull-request, and MishaKav/pytest-coverage-comment to specific commit SHAs with version comments.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/broken-links-checker.yml	Removes tj-actions/changed-files, uses git diff outputs, and pins lychee-action to a commit SHA.
.github/workflows/pr-title-checker.yml	Pins action-semantic-pull-request to a commit SHA.
.github/workflows/tests.yaml	Pins pytest-coverage-comment to a commit SHA.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.