Normalize frozen GitHub Actions version skew (follow-up to #13411)

[RayBB]

#13411 pinned all actions to SHAs, which froze pre-existing version skew in place:

• actions/checkout: v4.4.0 (issue_enrichment, pr_autoresponder) vs v7.0.1 elsewhere
• actions/github-script: v7.1.0 (pm_on_call_notification) vs v9.0.0 elsewhere

Consolidate to a single version of each action so the pin surface stays small and upgrades are uniform.

[openlibrary-bot]

⚠️ Contributors, this issue will be ready to work on once:

• Needs: Breakdown — issue lacks concrete implementation steps
• State: Blocked — pre-commit: Add zizmor security linter for GitHub Actions #13411 (the PR that introduces the SHA pins this issue describes) has not merged yet; the version skew below does not exist in master today

---

Context

• The skew this issue describes is not yet in master — it is introduced by the still-open pre-commit: Add zizmor security linter for GitHub Actions #13411 ("pre-commit: Add zizmor security linter for GitHub Actions"), which pins every third-party action to a SHA with a # vX.Y.Z comment. The diff for that PR (https://github.com/internetarchive/openlibrary/pull/13411/files) is where the two skews actually appear:
  • actions/checkout: pinned to 11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 in issue_enrichment.yml and pr_autoresponder.yml, vs 3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 in the other 10 occurrences (weekly_status_report.yml, docs_gh_pages.yml, new_comment_digest.yml, javascript_tests.yml, olbase.yaml x2, python_tests.yml, new_pr_labeler.yml, pm_on_call_notification.yml, pr_update_labeler.yml).
  • actions/github-script: pinned to f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 in pm_on_call_notification.yml, vs 3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 in code_review_action.yml, auto_assign_reviewer.yml, and pr_changes_requested.yml.
• In current master, the same two files show the pre-existing major-version skew as floating tags (not yet SHAs): actions/checkout@v4 in issue_enrichment.yml#L35 (

  openlibrary/.github/workflows/issue_enrichment.yml

  Line 35 in d4850c6

  - uses: actions/checkout@v4

  ) and pr_autoresponder.yml#L36 (

  openlibrary/.github/workflows/pr_autoresponder.yml

  Line 36 in d4850c6

  - uses: actions/checkout@v4

  ), vs actions/checkout@v7 everywhere else (e.g. python_tests.yml#L22:

  openlibrary/.github/workflows/python_tests.yml

  Line 22 in d4850c6

  - uses: actions/checkout@v7

  ); and actions/github-script@v7 in pm_on_call_notification.yml#L17 (

  openlibrary/.github/workflows/pm_on_call_notification.yml

  Line 17 in d4850c6

  uses: actions/github-script@v7

  ) vs @v9 elsewhere (e.g. auto_assign_reviewer.yml#L27:

  openlibrary/.github/workflows/auto_assign_reviewer.yml

  Line 27 in d4850c6

  uses: actions/github-script@v9

  ).
• The majority version in the pre-commit: Add zizmor security linter for GitHub Actions #13411 diff is checkout v7.0.1 (10 occurrences vs. 2) and github-script v9.0.0 (3 occurrences vs. 1) — consolidating toward those would touch only issue_enrichment.yml, pr_autoresponder.yml, and pm_on_call_notification.yml.
• Scope note: issue_enrichment.yml and pr_autoresponder.yml each have a second, unrelated anthropics/claude-code-action SHA pin a few lines below the checkout step, with an extensive comment explaining it is deliberately frozen to work around an upstream regression (Every Bash call fails under subprocess isolation since pinned CLI 2.1.216: bwrap: Can't create file at /home/.mcp.json: Permission denied anthropics/claude-code-action#1547). That pin is out of scope for this issue and should not be touched when normalizing the checkout/github-script versions.
• No related or duplicate issue was found in a search of open/closed issues for this version-skew topic.

---

Issue Assessment

Open questions

• Should the version bumps be folded into pre-commit: Add zizmor security linter for GitHub Actions #13411 itself before it merges, or filed as a separate follow-up PR afterward? This depends on the review timeline for pre-commit: Add zizmor security linter for GitHub Actions #13411 and is a call for whoever is shepherding that PR.

Action items

• Identify the exact files/lines affected (Answer: see Context section — 3 files, 3 pin updates once pre-commit: Add zizmor security linter for GitHub Actions #13411 merges)
• Merge or close out pre-commit: Add zizmor security linter for GitHub Actions #13411 first — this issue has no actionable diff to produce until the SHA pins it refers to actually land in master
• Confirm which target SHA/version to standardize on for each action (majority-vote candidates identified above, but a maintainer should confirm)

Suggested breakdown

• Wait for pre-commit: Add zizmor security linter for GitHub Actions #13411 to merge (or coordinate with its author, @cclauss, to fold this in directly)
• Bump actions/checkout in issue_enrichment.yml and pr_autoresponder.yml to the v7.0.1 SHA used elsewhere, leaving the adjacent claude-code-action pin untouched
• Bump actions/github-script in pm_on_call_notification.yml to the v9.0.0 SHA used elsewhere
• Verify the # vX.Y.Z comment convention is preserved on the updated lines

This is a small, mechanical diff (3 lines across 3 files) and could be a reasonable Good First Issue candidate once #13411 merges and the blocker clears.

---

Full triage checklist

• Triage — correct labels applied or removed
• Problem / opportunity — problem is clear, audience identified, actionable
• Scope — issue is well-scoped; does not try to do too many things
• Justification — reasoning and impact stated; sufficient for leads to prioritize
• Success & testing criteria — no explicit "done" definition stated (implicit: each action pinned to one version)
• Proposal & breakdown — no concrete task checklist or target versions specified
• If bug: environment & repro steps — not applicable, not a bug report
• Risks, concerns, open questions — not surfaced in the original issue text (see Context/Open questions above)
• Richy context — relevant code, commits, and PRs reviewed; no duplicate found
• References — no screenshots/designs needed for this change

---

Note

This comment was automatically generated by Richy (https://github.com/internetarchive/openlibrary/blob/master/.github/workflows/issue_enrichment.md), Open Library's issue enrichment assistant, on behalf of @mekarpeles. This is NOT a sign-off. This issue needs lead review before work begins.

[mekarpeles]

@RayBB I think this was done intentionally because a later version of the workflow inexplicably broke with claude subscription keys (there's several references in our merged and closed PRs citing this.

[RayBB]

@mekarpeles You are correct about claude-code-action: #13229 pinned it because the newer upstream version broke. This issue isn't to change that.

However, the checkout/github-script skew is not deliberate: renovate's v7 bump in #13054 missed only these two files. This PR changes only those two actions and leaves the claude pin in place.

Does that make sense to you?