On branch edburns/dd-2785864-pre-public-non-code-changes Pin actions to specific SHA per request from @karianna

modified:   .github/workflows/build-test.yml
modified:   .github/workflows/copilot-setup-steps.yml
modified:   .github/workflows/deploy-site.yml
modified:   .github/workflows/publish-maven.yml
modified:   .github/workflows/publish-snapshot.yml
modified:   .github/workflows/weekly-upstream-sync.yml

> prefer #commmit versions e.g., actions/checkout@#4s9df7sdf98d7f8s9df7sd9f87ds #v6.0.0
modified:   src/site/markdown/advanced.md

> I think we can word that differently as we are the official SDK.

Author: edburns

.github/workflows/build-test.yml

@@ -32,11 +32,11 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: 22
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           java-version: "17"
           distribution: "temurin"
@@ -78,7 +78,7 @@ jobs:
 
       - name: Upload test results for site generation
         if: success() && github.ref == 'refs/heads/main'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: test-results-for-site
           path: |

.github/workflows/copilot-setup-steps.yml

@@ -20,22 +20,22 @@ jobs:
     steps:
       # Clone the repository
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # Install GitHub CLI and gh-aw extension for Copilot Agent interaction
       - name: Install gh-aw extension
-        uses: github/gh-aw/actions/setup-cli@v0.42.17
+        uses: github/gh-aw/actions/setup-cli@7a970851c1090295e55a16e549c61ba1ce227f16 # v0.42.17
         with:
           version: v0.42.17
 
       # Setup Node.js
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: 22
 
       # Set up JDK 17
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           java-version: '17'
           distribution: 'temurin'

.github/workflows/deploy-site.yml

@@ -56,19 +56,19 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           java-version: '17'
           distribution: 'temurin'
           cache: 'maven'
 
       - name: Checkout gh-pages branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: gh-pages
           path: site
@@ -120,7 +120,7 @@ jobs:
 
       - name: Download test results from Build & Test
         if: steps.tags.outputs.is_release == 'false' && inputs.rebuild_all_versions != true && github.event_name == 'workflow_run'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: test-results-for-site
           path: /tmp/test-results
@@ -293,13 +293,13 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
         with:
           path: 'site'
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

.github/workflows/publish-maven.yml

@@ -38,7 +38,7 @@ jobs:
         outputs:
             version: ${{ steps.versions.outputs.release_version }}
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   fetch-depth: 0
                   token: ${{ secrets.GITHUB_TOKEN }}
@@ -51,10 +51,10 @@ jobs:
             - uses: ./.github/actions/setup-copilot
 
             - name: Set up JDK 17
-              uses: actions/setup-java@v5
+              uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
               with:
                   java-version: "17"
-                  distribution: "temurin"
+                  distribution: "microsoft"
                   cache: "maven"
                   server-id: central
                   server-username: MAVEN_USERNAME
@@ -169,7 +169,7 @@ jobs:
         if: github.ref == 'refs/heads/main'
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   fetch-depth: 0
             - name: Create GitHub Release

.github/workflows/publish-snapshot.yml

@@ -18,17 +18,17 @@ jobs:
         name: Publish SNAPSHOT to Maven Central
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   fetch-depth: 0
 
             - uses: ./.github/actions/setup-copilot
 
             - name: Set up JDK 17
-              uses: actions/setup-java@v5
+              uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
               with:
                   java-version: "17"
-                  distribution: "temurin"
+                  distribution: "microsoft"
                   cache: "maven"
                   server-id: central
                   server-username: MAVEN_USERNAME

.github/workflows/weekly-upstream-sync.lock.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check for upstream changes
         id: check

.github/workflows/weekly-upstream-sync.yml

@@ -1,6 +1,6 @@
 # Advanced Usage
 
-> ⚠️ **Disclaimer:** This SDK tracks the pre-GA GitHub Copilot SDKs for .NET and nodejs. This SDK may change in breaking ways. Use at your own risk.
+> **Disclaimer:** This is the official Java SDK for GitHub Copilot. This repository treats the official .NET and nodejs SDKs for GitHub Copilot as reference implementations. These SDKS are all officially supported as GitHub open source projects. The Java implementation follows the backward compatibility guarantees offered by the reference implementations. As such this implementation may introduce breaking changes, according to the policy declared by the reference implementations. Use at your own risk.
 
 This guide covers advanced scenarios for extending and customizing your Copilot integration.