update deprecated github actions

fixes #6875

.github/workflows/issue-analysis.yml

@@ -61,7 +61,7 @@ jobs:
     steps:
       - name: Verify sender permission
         id: verify
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           ORG_READ_TOKEN: ${{ secrets.EARENDIL_ORG_READ_TOKEN }}
         with:
@@ -254,19 +254,19 @@ jobs:
     steps:
       - name: Create high-entropy working directory name
         id: workdir
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const crypto = require('crypto');
             core.setOutput('name', `pi-ci-${crypto.randomBytes(16).toString('hex')}`);
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: ${{ steps.workdir.outputs.name }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -319,7 +319,7 @@ jobs:
 
       - name: Write auth.json
         id: write_auth
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PI_AUTH_JSON: ${{ secrets.PI_AUTH_JSON }}
         with:
@@ -341,7 +341,7 @@ jobs:
             }
 
       - name: Run pi /is
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PI_CODING_AGENT_DIR: ${{ runner.temp }}/pi-agent
           GH_TOKEN: ${{ github.token }}
@@ -404,7 +404,7 @@ jobs:
 
       - name: Persist refreshed auth.json
         if: always() && steps.write_auth.outcome == 'success'
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_TOKEN: ${{ secrets.PI_AUTH_UPDATE_TOKEN }}
           PI_CODING_AGENT_DIR: ${{ runner.temp }}/pi-agent
@@ -457,7 +457,7 @@ jobs:
       - name: Export session files
         id: export_session_files
         if: always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PI_CODING_AGENT_DIR: ${{ runner.temp }}/pi-agent
           WORKDIR: ${{ steps.workdir.outputs.name }}
@@ -509,7 +509,7 @@ jobs:
       - name: Upload session gist
         id: gist
         if: always() && steps.export_session_files.outcome == 'success'
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PI_GIST_TOKEN: ${{ secrets.PI_GIST_TOKEN }}
         with:
@@ -540,7 +540,7 @@ jobs:
 
       - name: Comment with session import instructions
         if: always() && steps.gist.outcome == 'success'
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GIST_URL: ${{ steps.gist.outputs.url }}
           GIST_ID: ${{ steps.gist.outputs.id }}
@@ -619,7 +619,7 @@ jobs:
 
       - name: Remove trigger label
         if: always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             try {