fix(ci): validate and sync composite action pins against the actions registry

[qubeena07]

Summary

Closes #3366.

The two composite actions under .github/actions, contributor-check and ai-agent-runner, pin actions/setup-python and actions/setup-node directly and were never checked against .github/ci/actions.toml. They had already drifted to older versions than the registry without anything catching it.

This teaches scripts/ci/generate_workflows.py to also read those composite action files. Check now fails if a pinned action there does not match the registry entry for that same action name, and write rewrites just the uses line to match the registry, leaving the rest of the file untouched. The ci generation check workflow now also runs on changes under .github/actions so this stays guarded going forward.

Ran generate_workflows.py --write once to bring both files back in sync with the current registry, and added tests covering the new check and sync behavior.

Test plan

• python3 scripts/ci/generate_workflows.py --check passes, generated workflows are up to date
• python3 -m pytest tests/ci passes, 76 tests including the four new ones
• all touched yaml files parse cleanly with yaml.safe_load
• confirmed the diff on both composite action files only touches the uses line, nothing else

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

🤖 AI Agent: breaking-change-detector — API Compatibility

AI-generated review output. Treat it as untrusted analysis and verify before acting.

API Compatibility

No breaking changes detected.

[github-actions]

🤖 AI Agent: docs-sync-checker — Docs Sync

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Docs Sync

• check_composite_action_pins(actions: dict[str, str]) in scripts/ci/generate_workflows.py -- missing docstring
• sync_composite_action_pins(actions: dict[str, str]) in scripts/ci/generate_workflows.py -- missing docstring
• README.md -- no updates detected to reflect the new functionality of generate_workflows.py regarding composite action pin validation and synchronization.
• CHANGELOG -- missing entry for the new behavior of generate_workflows.py to validate and sync composite action pins against the actions registry.

[github-actions]

🤖 AI Agent: test-generator — `scripts/ci/generate_workflows.py`

AI-generated review output. Treat it as untrusted analysis and verify before acting.

scripts/ci/generate_workflows.py

• test_composite_action_error_handling -- validate behavior when COMPOSITE_ACTIONS_DIR is missing or inaccessible.
• test_invalid_action_format -- ensure the script handles malformed action.yml files gracefully.
• test_registry_mismatch_handling -- verify error handling when the registry file is missing or corrupted.
• test_empty_composite_action_dir -- confirm no errors occur when COMPOSITE_ACTIONS_DIR is empty.

[github-actions]

🤖 AI Agent: code-reviewer — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

TL;DR: 0 blockers, 0 warnings. The changes improve CI robustness by ensuring composite action pins are validated and synchronized with the actions registry.

#	Sev	Issue	Where

No action required. Clean change.

[github-actions]

🤖 AI Agent: security-scanner — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

No security issues found.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[MohammadHaroonAbuomar]

• Sequencing: merge #3365 first, then rebase this and re-run scripts/ci/generate_workflows.py --write. Verified locally: clean git merge but real semantic conflict — this PR synced composite pins against main's current registry; #3365 moves setup-python to v6.3.0, so whichever merges second leaves main's ci-generation-check red (contributor-check/action.yml pinned to v6.2.0, registry expects v6.3.0). One --write re-run fixes it.
• (process) MAINTAINER: 15 action_required; approve runs. Check itself verified fail-closed empirically (drift -> exit 1).

Minor:

• setup-node v4.4.0->v6.4.0 in ai-agent-runner is a two-major registry-driven jump; node-version:22 is explicit so low risk, but worth a smoke run of that composite.

[imran-siddique]

Hi @qubeena07, this PR has requested changes that are still open, with no update for a while. Could you address the review feedback when you have a chance? If there is no activity within one week we will close this to keep the review queue manageable, and you are welcome to reopen once you are ready. Thanks for the contribution.

[qubeena07]

Sure @imran-siddique. I'll look into it.

[qubeena07]

Thanks for the review,@MohammadHaroonAbuomar. Quick status update so this does not go stale.

You are right about the sequencing conflict. This PR synced the composite pins against the current registry, but #3365 is about to move setup-python to v6.3.0, so whichever of us merges second will leave ci generation check red on main. I am waiting on #3365 to merge first, then I will rebase this branch and rerun generate_workflows.py with write so the pins line up again.

On the minor note, this PR's own CI already exercised the ai-agent-runner composite with the updated setup-node pin. The AI PR Review workflow on this branch ran all five agent jobs through it and they completed fine, so the two major jump looks safe in practice.

I will push the rebase and rerun as soon as #3365 lands. Keeping an eye on it now.