ci: arm action-pins on this repo now that #159 has promoted to main (backend#1603 step 2)

[LukasWodka]

Closes backend#1603.

What changed and why it could not be done sooner

#171 gave this repo the org's own quality suite but had to leave action-pins off, because the job and its two inputs were added in #159 and existed on develop only — while a caller must reference @main (Q3). Passing an input the @main callee does not declare kills the entire reusable call with a startup_failure, not just the one job. Measured on that branch's first push, run 31086491251: every other check reported normally and Code quality never started.

#159 has since promoted. I verified the @main copy directly rather than assuming the promotion carried what it looks like it carried:

code-quality.yml @ main
jobs: ruff, format, shellcheck, gitleaks, house-rules, action-pins
inputs: … action-pins, action-pins-soft-fail …

Hard-armed, deliberately

action-pins-soft-fail: false rather than inheriting the soft-fail default. This is the specific check whose absence let #168 revert actions/checkout from a pinned commit SHA to the mutable @v4 tag with nothing in CI to object — in advance-deploy-env.yml, the most-consumed reusable workflow in the org, running with PROJECTS_KANBAN_TOKEN in scope. A human reading the diff caught it, which is the review path D10 exists to stop depending on.

Every other repo consumes these workflows at @main and inherits whatever refs they pin, so this repo has a specific duty to enforce the rule it publishes.

Arming imports no backlog

Re-measured immediately before flipping: 24 uses: refs across 23 workflows, zero violations. Expect quality / action-pins green on this PR.

Also confirmed live elsewhere: quality / action-pins now reports on frontend-app PRs, so the promoted job is genuinely running fleet-wide rather than only existing on paper.

Parent backend#1405.

---

Note

Low Risk
Workflow-only change that tightens CI; no runtime app, auth, or data-path changes.

Overview
Turns on the reusable workflow’s action-pins job for this repo by passing action-pins: true and action-pins-soft-fail: false from code-quality-caller.yml, replacing the prior comment block that deferred arming until #159 was on @main.

PRs here will now fail CI on unpinned third-party uses: refs (org @main reusables stay allowed), so the org workflow publisher enforces the same pin rule it ships to other repos.

^{Reviewed by Cursor Bugbot for commit 38578ff. Bugbot is set up for automated code reviews on this repo. Configure here.}