[WIP] DEVOPS-1133: Pin GitHub Actions to commit hashes

[RomFloreani]

DEVOPS-1133 - pin all GitHub actions and reusable workflows to hash
Expands moving GitHub Actions tags to the full semver tag pointing at the same commit, then pins every uses: to a commit hash with a dependabot-readable version comment.

Tags expanded in this repo:

• atlassian/gajira-login@v3.0.1 -> @v3.0.1
• atlassian/gajira-create@v3.0.1 -> @v3.0.1
• peter-evans/create-or-update-comment@v4 -> @v4.0.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3 -> @v3.12.0
• actions/checkout@v4 -> @v4.4.0
• mamba-org/setup-micromamba@v1 -> @v1.11.0
• codecov/codecov-action@v4 -> @v4.6.0

Workflows added:

• .github/workflows/dependabot-auto-merge.yml
• .github/workflows/wip-status.yml

All MiraGeoscience/CI-tools reusable workflows are pinned to 7241532854727d993872b67fc761139b8438615b (v3.12.0).

[Copilot]

Pull request overview

This PR aims to harden the repository’s GitHub Actions supply chain by moving uses: references away from floating tags; the current diff updates several workflow files by expanding @vN references to full semver tags (e.g., @v4 → @v4.4.0).

Changes:

• Expanded actions/checkout and mamba-org/setup-micromamba references to full semver tags in CI workflows.
• Updated codecov/codecov-action to v4.6.0 in the Windows pytest workflow.
• Updated Jira-related workflow references (MiraGeoscience/CI-tools reusable workflow and peter-evans/create-or-update-comment) to full semver tags.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
.github/workflows/static-analysis.yml	Expands checkout/micromamba action refs to full semver tags for static analysis job.
.github/workflows/pytest-windows.yml	Expands checkout/micromamba and updates Codecov action ref to full semver tags for Windows tests.
.github/workflows/pytest-unix-os.yml	Expands checkout/micromamba action refs to full semver tags for Unix tests.
.github/workflows/pr_jira_actions.yml	Expands reusable Jira workflow ref to a full semver tag.
.github/workflows/issue_to_jira.yml	Expands comment action ref to a full semver tag for Jira issue linkage.

Comments suppressed due to low confidence (1)

.github/workflows/pytest-windows.yml:57

• This workflow step still uses codecov/codecov-action@v4.6.0 (a mutable tag). To match the PR goal of pinning actions, switch this to the exact commit SHA with a Dependabot-readable version comment.

        if: ${{ success() && matrix.python_ver == '3.10' }}
        uses: codecov/codecov-action@v4.6.0
        with:

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

⚠️ Force push detected - Previous Copilot review comments may no longer be relevant to the current code. Please resolve any outdated threads and re-request a Copilot review when ready.

[github-actions]

⚠️ Force push detected - Previous Copilot review comments may no longer be relevant to the current code. Please resolve any outdated threads and re-request a Copilot review when ready.

[RomFloreani]

These PRs won't have the auto-merge because they need all checks to pass.

Blocking required check here: Pytest / Pytest (3.10, ubuntu-latest), Pytest / Pytest (3.10, windows-latest) - never report - the repo-level require-status-checks ruleset still names Python 3.10, which is no longer in the matrix.

The pinning change itself is complete; this is pre-existing and tracked separately.