Fix/add action sha

[pikes-ons]

Updated github workflows to include full commit SHAs rather than versions as per new guidance. Added a workflow to automatically update CHANGELOG.md. This has not been fully tested yet as can only be tested with a tag commit. Deploy docs workflow has not been changed at all due to parallel work ongoing.

[Copilot]

Pull request overview

This PR updates GitHub Actions workflows to pin actions by full commit SHA for supply-chain hardening, and introduces automated changelog generation on version tags using git-cliff.

Changes:

• Pin actions/checkout and actions/setup-python to specific commit SHAs in existing CI/build workflows.
• Add a git-cliff configuration (cliff.toml) to generate CHANGELOG.md.
• Add a new changelog_update.yml workflow to generate and commit changelog updates on version tag pushes.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
cliff.toml	Adds git-cliff changelog template and commit parsing rules.
.github/workflows/python-package.yml	Pins GitHub Actions dependencies to full commit SHAs in Python CI.
.github/workflows/package-build.yml	Pins GitHub Actions dependencies to full commit SHAs in package build workflow.
.github/workflows/changelog_update.yml	Adds a tag-triggered workflow to generate, commit, and retag changelog updates.

Suppressed comments (2)

.github/workflows/changelog_update.yml:21

• The checkout step will run on the tag ref (detached HEAD) for tag pushes, so the subsequent git push origin HEAD:main can accidentally move main to the tag commit history. Check out main explicitly before generating/committing the changelog so the push updates the branch you intend.

            - name: Checkout Branch
              uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
              with:
                fetch-depth: 0
                token: ${{ secrets.ACCESS_TOKEN }}

.github/workflows/changelog_update.yml:40

• INPUT_TAG_NAME won't be populated for a workflow_dispatch input; as written, manual runs will likely fall back to GITHUB_REF (which isn't a tag ref) and produce the wrong tag name. Use the workflow input (when present) or github.ref_name for tag pushes.

                TAG_NAME="${INPUT_TAG_NAME:-${GITHUB_REF#refs/tags/}}"

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

.github/workflows/changelog_update.yml:24

• Using a PAT (secrets.ACCESS_TOKEN) for checkout/push can re-trigger workflows on the subsequent git push / force-tag, creating an accidental workflow loop. Prefer the built-in GITHUB_TOKEN here (it won’t trigger new workflow runs from its own pushes) unless you have a specific protection-bypass requirement.

            - name: Checkout Branch
              uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
              with:
                fetch-depth: 0
                token: ${{ secrets.ACCESS_TOKEN }}
            - name: Generate changelog

.github/workflows/python-package.yml:52

• Same indentation issue in the tests job: the step list items are not indented under steps:, which will prevent the workflow from parsing.

    steps:
    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
      with: