[nborges-aws]

Description

Use commit SHAs pins instead of version pins on github action workflows

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran bun test
• I ran the relevant end-to-end tests with bun run test:e2e, or explained why they are not applicable
• I ran bun run typecheck
• I ran bun run lint:check
• I ran bun run format:check
• I ran bun run build
• If I modified src/assets/, I updated affected snapshots with bun test <test-file> --update-snapshots and committed them

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[github-actions]

Package Tarball

aws-agentcore-1.0.1.tgz

How to install

gh release download pr-2740-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-1.0.1.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Reviewed against the PR's base branch (v1.x). This is a pure CI hardening change — every mutable tag ref is replaced with an immutable commit SHA plus a version comment.

Verification I performed:

• All 9 pinned SHAs resolve to the tags claimed in the trailing comments (checked via the GitHub refs/tags API, dereferencing annotated tags):
  • actions/checkout@3d3c42e → v7.0.1 ✅
  • actions/setup-node@949feb2 → v7.1.0 ✅
  • oven-sh/setup-bun@0c5077e → v2.2.0 ✅
  • astral-sh/setup-uv@37802ad → v7.6.0 ✅
  • aws-actions/configure-aws-credentials@e125382 → v6.3.0 ✅
  • github/codeql-action/{init,analyze}@9b32540 → v4.39.1 ✅
  • actions/create-github-app-token@64ab729 → v3.3.0 ✅
  • marocchino/sticky-pull-request-comment@5770ad5 → v3.0.5 ✅
  • codecov/codecov-action@303a32d → v7.1.1 ✅
• Completeness: after applying the diff to v1.x, no uses: reference anywhere under .github/ still points at a floating tag or branch. The remaining non-SHA-looking refs (aws/agentcore-devx-devtools/...) were already commit-pinned on the base branch.
• No behavioral drift: pins are at the same major versions that were previously resolved by the floating tags, no with: inputs changed, and conditional guards (if: steps.package-manager.outputs.name == ...) are preserved.
• Staleness is covered: .github/dependabot.yml already has a weekly github-actions ecosystem entry (for both / and target-branch: v0.x), so Dependabot will keep these SHAs rolling forward — this is important specifically for github/codeql-action, which otherwise goes stale.
• Docs/format: the .github/workflows/README.md edit matches the new reality, and the reflowed line is 93 chars (under printWidth: 100, proseWrap default preserve), so format:check won't complain. No new lines exceed previously existing line-length norms.

No issues found; good to merge.

One optional, pre-existing observation (not introduced here, no action needed for this PR): the internal fetch-secrets composite action is pinned to two different devtools commits — 75989f6 in canary-v0.yml/canary.yml/e2e-test.yml and 31aa3b0 in pr-automation.yml. Worth consolidating in a follow-up.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.54%. Comparing base (796277b) to head (46724bc).

Additional details and impacted files

@@           Coverage Diff           @@
##             v1.x    #2740   +/-   ##
=======================================
  Coverage   96.54%   96.54%           
=======================================
  Files         706      706           
  Lines       58543    58543           
=======================================
  Hits        56521    56521           
  Misses       2022     2022           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jariy17]

Follow up Task: Add a linter to prevent developers from using npm tags in workflowso or at least Update the contributing.md, this should make our harness reviewer flag this.