fix: Pin GitHub Actions to commit SHAs

[PrekshithD-Microsoft]

This pull request updates workflow files to improve security and maintainability by pinning GitHub Actions to specific commit SHAs instead of floating tags. Additionally, it enhances the deployment process by adding a user notice before provisioning. Below are the most important changes grouped by theme:

Security and Maintenance: Pinning GitHub Actions to SHAs

• Updated all actions/checkout usages in workflow files (such as .github/workflows/azd-template-validation.yml, azure-dev.yml, broken-links-checker.yml) to reference a specific commit SHA instead of a version tag, ensuring builds use a known, immutable version. [1] [2] [3]
• Pinned other GitHub Actions (e.g., microsoft/template-validation-action, Azure/setup-azd, azure/login, lycheeverse/lychee-action, amannn/action-semantic-pull-request, actions/stale) to specific SHAs in their respective workflow files for improved security and reproducibility. [1] [2] [3] [4] [5] [6] [7]

Deployment Experience Improvement

• Added a preprovision PowerShell hook in azure.yaml to display a deployment notice to users, encouraging them to open an issue with logs if deployment fails, improving user guidance and support.## Purpose

• ...

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Pull request overview

This PR aims to harden and stabilize CI/CD by pinning GitHub Actions to immutable commit SHAs (instead of floating tags), improving supply-chain security and workflow reproducibility.

Changes:

• Pinned multiple GitHub Actions uses: references (e.g., actions/checkout, azure/login, actions/stale, lychee-action, semantic PR title checker) to specific commit SHAs.
• Updated the azd template validation workflow to use a pinned SHA for microsoft/template-validation-action.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/stale-bot.yml	Pins actions/stale to a commit SHA.
.github/workflows/pr-title-checker.yml	Pins the semantic PR title checker action to a commit SHA.
.github/workflows/broken-links-checker.yml	Pins actions/checkout and lycheeverse/lychee-action to commit SHAs.
.github/workflows/azure-dev.yml	Pins actions/checkout, Azure/setup-azd, and azure/login to commit SHAs.
.github/workflows/azd-template-validation.yml	Pins actions/checkout and microsoft/template-validation-action to commit SHAs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.