Populate version tags in comments for SHA-pinned GitHub Actions

[arkid15r]

Community & Support: LinkedIn Group · Slack #project-nest

Active project leaders: Arkadii Yakovets -- GitHub · LinkedIn · Slack; Kate Golovanova -- GitHub · LinkedIn · Slack

Contributing · Code of Conduct · GSoC Mentors

---

Describe the solution you'd like

Recently, we pinned all GitHub Actions workflows to commit SHAs for improved security and reproducibility. While this is the recommended best practice, it reduces visibility into which version of an action is actually being used.

For every SHA-pinned action, include the corresponding version tag as a comment:

• uses: actions/checkout@3df4ab11b4... # v4.1.0

This provides:

• human-readable version context
• easier debugging and auditing
• better clarity when Dependabot proposes updates

Acceptance Criteria

• All SHA-pinned GitHub Actions include a version comment
• Comments follow a consistent format (e.g., # vX.Y.Z)
• No functional changes to workflows

Are you going to work on implementing this?

• Yes
• No

[anukalp2804]

Hi @arkid15r
I would like to work on this issue. Can you please assign it to me?

[ItsImran10140]

Hi @arkid15r can I work on this one

[Harikishanth]

Hello @arkid15r I would like to work on this issue and come up with a solution which satisfies the accpetance criteria you stated....so can you assign this issue to me ?
Thank you!

[netram75]

Hi @arkid15r , I noticed this was unassigned a couple of days ago. I'd like to pick it up.