composite actions in .github/actions are not covered by the actions.toml pin registry and have already drifted

[qubeena07]

.github/ci/actions.toml is meant to be the pin registry that every workflow pulls its action versions from. It is enforced by scripts/ci/generate_workflows.py and checked in the ci generation check workflow, but that check only regenerates policy-engine-ci.yml. It never looks at the two composite actions under .github/actions.

Those composite actions already pin different, older versions than the registry. contributor-check/action.yml pins actions/setup-python@a26af69 which is v5.6.0, while the registry currently pins v6.2.0. ai-agent-runner/action.yml pins actions/setup-node@49933ea which is v4.4.0, while the registry pins v6.4.0.

So the registry is not actually the single place these versions live. These two files drifted silently and nothing caught it.

Suggested fix: either extend the generator and its check so it also validates composite action pins against the registry, or document that composite actions are intentionally out of scope and update them by hand whenever the registry changes.

Steps to reproduce

Grep .github/actions for actions/setup-python@ and actions/setup-node@ and compare the SHAs and version comments against .github/ci/actions.toml.

[saisharan0103]

The repro details point to .github/actions/contributor-check/action.yml still using actions/setup-python v5.6.0 while .github/ci/actions.toml has v6.2.0, and ai-agent-runner/action.yml doing the same with setup-node v4.4.0 versus v6.4.0. For a PR, I would start by extending scripts/ci/generate_workflows.py or its validation path so composite action pins are checked against the registry, then update the drifted pins.