fix(ci): pin rotation workflow actions to commit SHAs

[serena-ruan]

Related issue

N/A

Summary

The Discord watch rotation workflow failed on its first scheduled run (run 29083842707):

The actions actions/checkout@v4 and actions/setup-python@v5 are not allowed in omnigent-ai/omnigent because all actions must be pinned to a full-length commit SHA.

The org enforces SHA-pinned actions. This pins both to the same commit SHAs the repo's other workflows already use:

• actions/checkout → 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 (v7.0.0)
• actions/setup-python → a309ff8b426b58ec0e2a45f0f869d46889d02405 (v6.2.0)

Test Plan

• pre-commit run check-yaml passes on the workflow file.
• SHAs verified against the pins used by other workflows in .github/workflows/ (grep).
• Confirmed via the run log that the two unpinned actions were the only cause of the failure (the job failed at "Set up job", before running the script).

Demo

N/A — non-visual CI fix.

Type of change

• Bug fix
• Feature
• UI / frontend change
• Refactor / chore
• Docs
• Test / CI
• Breaking change

Test coverage

• Unit tests added / updated
• Integration tests added / updated
• E2E tests added / updated
• Manual verification completed
• Existing tests cover this change
• Not applicable

Coverage notes

Verified by matching the pinned SHAs to those used by other workflows in the repo and by reading the failing run log, which showed the unpinned actions were rejected at job setup. No code paths changed.

This pull request and its description were written by Isaac.

[omnigent-ci]

Polly AI Review

Review: fix(ci): pin rotation workflow actions to commit SHAs

1. Blocking issues

None.

2. Security vulnerabilities

None. This change strengthens the supply-chain posture by replacing floating tags (@v4, @v5) with full-length commit SHAs, satisfying the org's pinning requirement. The two SHAs match exactly what the rest of the repo already uses:

• actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 (v7.0.0) — used by 63 other pins.
• actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 (v6.2.0) — used by 22 other pins.

No secrets, tokens, or credentials are touched.

3. Non-blocking notes

• Version bump note (informational, not a defect): the previous floats were checkout@v4 / setup-python@v5; the new pins are v7.0.0 / v6.2.0. Since the job only checks out the repo and sets up Python 3.12 to run a simple rotation-ping script, the major-version jump is low-risk and consistent with every other workflow in the repo.

4. Summary

Correct, minimal, and safe. The diff pins the two previously-unpinned actions to the exact commit SHAs already in use across .github/workflows/, directly resolving the "must be pinned to a full-length commit SHA" failure at job setup. No functional behavior changes and no security concerns — ready to merge.

---

_{Automated review by Polly · workflow run}

[github-actions]

🏷️ Doc impact: no-doc-update

This only pins GitHub Actions dependencies to commit SHAs in a CI workflow, an internal tooling change with no user-facing surface affected.

_{Auto-classified on merge. Set the label manually before merging to override. · run}