ci: pin GitHub Actions to commit SHAs

[mirkosalvato1-ctrl]

Why

Mutable Action tags (@v4, @main) can be retagged, which is a supply-chain risk.
This PR pins third-party Actions to full commit SHAs while keeping the tag in a comment.
Official actions/* tags are left unchanged (common maintainer preference).

Pins

• codecov/codecov-action@v7 -> fb8b3582c8e4
• codecov/codecov-action@v7 -> fb8b3582c8e4
• actions/github-script@v7 -> f28e40c7f34b
• actions/github-script@v7 -> f28e40c7f34b

Reference: GitHub docs on using third-party actions securely.

[filigran-cla-bot]

Contributor License Agreement

Hey @mirkosalvato1-ctrl!

Thank you for your contribution to Filigran! Before we can merge this pull request, we need you to sign our Contributor License Agreement (CLA).

Why do we need a CLA?

The CLA helps protect both you and Filigran. It ensures that:

• You have the right to make this contribution
• Filigran can use and distribute your contribution
• Your contribution remains open source

How to sign

You can sign the CLA using either of these methods:

1. 🔗 Sign directly — Click here to review and sign the CLA
2. 📧 Via email — Check your inbox (and spam folder) for a signing invitation from Concord

Once signed, this comment will be automatically updated.

---

❌ CLA not signed yet

_{This is an automated message from the Filigran CLA Bot. If you have questions, please contact the maintainers.}

[Copilot]

Pull request overview

This PR hardens the repository’s GitHub Actions workflows by replacing mutable third-party Action tags with pinned commit SHAs (while keeping the original tag as an inline comment) to reduce supply-chain risk.

Changes:

• Pin actions/github-script usage in the unused-deps workflow to a specific commit SHA.
• Pin codecov/codecov-action usage in the connectors test workflow to a specific commit SHA.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/ci-unused-deps.yml	Pins actions/github-script to a commit SHA for deterministic execution in PR commenting steps.
.github/workflows/ci-tests-connectors.yml	Pins codecov/codecov-action to a commit SHA for coverage and test-results uploads.

Comments suppressed due to low confidence (1)

.github/workflows/ci-unused-deps.yml:143

• Same as above: this pins the official actions/github-script action, which contradicts the PR description’s claim that official actions/* tags are left unchanged. Align either the description or this uses: reference.

        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b  # v7

[Filigran-Automation]

🤖 [AI-generated]

Hey @mirkosalvato1-ctrl! 👋 Thanks a lot for opening this PR — really appreciate you hardening our CI supply-chain security by pinning Actions to commit SHAs! 🙏

I just had a quick look and I think the description could be enhanced a little to help reviewers get through it faster. I haven't changed anything in your description — just a gentle suggestion:

Area	What could help	Suggestion
Linked issue	The PR isn't linked to a GitHub issue	Our contribution guidelines ask that every PR be created along with an associated issue describing the purpose of the change. Could you open (or reference) an issue describing this Actions-pinning initiative and link it here (e.g. "Closes #123")?

💡 If helpful, the contribution conventions walk through what to include.

No rush at all — thanks again for contributing to the project! 🚀