feat(CAS-108): pin all GitHub Actions to full SHAs and add actions policy

- Pin all 23 mutable action refs (tags/branches) to full commit SHAs
- Critically: replace trivy-action@master with SHA-pinned ref
- Manually pin github/codeql-action/upload-sarif@v4 (path action, requires
  manual resolution: c10b8064de6f491fea524254123dbe5e09572f13)
- Add .cascadeguard/actions-policy.yaml with deny-by-default policy
- Add exception for deprecated actions/create-release (expires 2026-12-31)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Author: Founding Engineer

.cascadeguard/actions-policy.yaml

@@ -0,0 +1,30 @@
+# CascadeGuard Actions Policy
+# Schema: https://cascadeguard.dev/schemas/actions-policy/v1
+#
+# All external GitHub Actions used in this repository must appear in
+# allowed_actions or be published by a trusted owner in allowed_owners.
+
+version: "1"
+
+# Reject any action not explicitly permitted below.
+default: deny
+
+# GitHub organisations whose actions are trusted by default.
+allowed_owners:
+  - actions       # github.com/actions/*
+  - docker        # github.com/docker/*
+
+# Specific actions permitted by name (owner/repo).
+allowed_actions:
+  - arduino/setup-task
+  - aquasecurity/trivy-action
+  - github/codeql-action/upload-sarif
+
+# Actions that are always denied, even if the owner is trusted.
+denied_actions: []
+
+# One-off exceptions — each must include a 'reason'.
+exceptions:
+  - action: actions/create-release
+    reason: "Deprecated action still used for release automation; migrate to softprops/action-gh-release"
+    expires: "2026-12-31"

.github/workflows/_component-test-acceptance.yml

@@ -21,24 +21,24 @@ jobs:
   acceptance-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
           token: ${{ secrets.SUBMODULE_PAT }}
-      - uses: arduino/setup-task@v1
+      - uses: arduino/setup-task@e26d8975574116b0097a1161e0fe16ba75d84c1c # v1
         with:
           version: 3.x
           repo-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Node.js (for Playwright tests)
         if: hashFiles(format('{0}/tests/acceptance/package.json', inputs.component-path)) != ''
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '18'
           cache: 'npm'
           cache-dependency-path: ${{ inputs.component-path }}/tests/acceptance/package-lock.json
       - name: Setup Python (for pytest tests)
         if: hashFiles(format('{0}/**/pytest.ini', inputs.component-path)) != '' || hashFiles(format('{0}/**/pyproject.toml', inputs.component-path)) != ''
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
         with:
           python-version: '3.11'
       # - name: Install UV (for Python projects)

.github/workflows/_component-test-fast.yml

@@ -20,24 +20,24 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
           token: ${{ secrets.SUBMODULE_PAT }}
-      - uses: arduino/setup-task@v1
+      - uses: arduino/setup-task@e26d8975574116b0097a1161e0fe16ba75d84c1c # v1
         with:
           version: 3.x
           repo-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Node.js (for npm tests)
         if: hashFiles(format('{0}/**/package.json', inputs.component-path)) != ''
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '18'
           cache: 'npm'
           cache-dependency-path: ${{ inputs.component-path }}/package-lock.json
       - name: Setup Python (for pytest tests)
         if: hashFiles(format('{0}/**/pytest.ini', inputs.component-path)) != '' || hashFiles(format('{0}/**/pyproject.toml', inputs.component-path)) != ''
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
         with:
           python-version: '3.11'
       # - name: Install UV (for Python projects)

.github/workflows/_docker-build.yml

@@ -57,7 +57,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
           fetch-depth: 0
@@ -69,7 +69,7 @@ jobs:
 
       - name: Set up Node.js (for package.json versioning)
         if: inputs.version_type == 'package-json'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
 
@@ -143,21 +143,21 @@ jobs:
           fi
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Log in to Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ inputs.registry }}
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GHCR_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Build and Push Docker image
         id: build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: ${{ inputs.context }}
           file: ${{ inputs.dockerfile }}
@@ -171,15 +171,15 @@ jobs:
 
       # Trivy will now pull the image from the registry since it's not loaded locally
       - name: Run Trivy security scan
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # master
         with:
           image-ref: ${{ inputs.registry }}/${{ inputs.image_name }}:${{ steps.new_version.outputs.version }}
           format: 'sarif'
           output: 'trivy-results.sarif'
           severity: 'CRITICAL,HIGH'
 
       - name: Upload Trivy results
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'
@@ -267,7 +267,7 @@ jobs:
 
       - name: Create GitHub Release
         if: success() && github.ref_name == 'main'
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         continue-on-error: true # Don't fail if release already exists (race condition or re-run)

.github/workflows/backstage.yml

@@ -37,18 +37,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
           token: ${{ secrets.SUBMODULE_PAT }}
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
         with:
           python-version: '3.11'
 
       - name: Install Task
-        uses: arduino/setup-task@v1
+        uses: arduino/setup-task@e26d8975574116b0097a1161e0fe16ba75d84c1c # v1
         with:
           version: 3.x
           repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -65,14 +65,14 @@ jobs:
         run: task platform:ingress:test:backstage
 
       - name: Upload test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
           name: backstage-kustomize-test-results
           path: platform/ingress/tests/kustomize/backstage-test-results.xml
 
       - name: Upload test report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
           name: backstage-kustomize-test-report

.github/workflows/repo-maintenance.yml

@@ -14,12 +14,12 @@ jobs:
   maintenance:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
           token: ${{ secrets.SUBMODULE_PAT }}
 
-      - uses: arduino/setup-task@v1
+      - uses: arduino/setup-task@e26d8975574116b0097a1161e0fe16ba75d84c1c # v1
         with:
           version: 3.x
           repo-token: ${{ secrets.GITHUB_TOKEN }}