fix: pin secure-action-inputs to v1.0.0 SHA instead of floating @main

[rajbos]

Now that devops-actions/secure-action-inputs has a tagged v1.0.0 release, this pins the reusable workflow's action reference by commit SHA (with version comment) instead of the floating @main branch ref.

Why: Dependabot's github_actions update checker requires at least one git tag on the referenced repo before it will compute a new commit SHA for updates (see latest_commit_sha in dependabot-core, which returns early when latest_version_tag is nil). A floating @main ref is also never tracked by Dependabot at all — it only updates SHA or tag pins.

Related:devops-actions/.github and devops-actions/secure-action-inputs both previously had zero tags, which is also why Dependabot never proposed updates to consumers' SHA-pinned uses: devops-actions/.github/.github/workflows/secure-inputs.yml@<sha> # main references. Both repos now have a v1.0.0 tag/release to unblock that.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA b07199e.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

.github/workflows/secure-inputs.yml

Package	Version	License	Issue Type
devops-actions/secure-action-inputs	e99fc0a00a1170cdab03c4a84b00e8c973ad28db	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/devops-actions/secure-action-inputs	e99fc0a00a1170cdab03c4a84b00e8c973ad28db	🟢 7.3	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dependency-Update-Tool 🟢 10 update tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review ⚠️ 0 Found 0/4 approved changesets -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Signed-Releases ⚠️ -1 no releases found License ⚠️ 0 license file not detected Vulnerabilities 🟢 8 2 existing vulnerabilities detected Fuzzing ⚠️ 0 project is not fuzzed Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST 🟢 10 SAST tool is run on all commits Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 CI-Tests 🟢 10 14 out of 14 merged PRs checked by a CI test -- score normalized to 10

Scanned Files

• .github/workflows/secure-inputs.yml