Harden link validator workflow dependencies

[Celeste de Guzman (CelesteDG)]

Summary

• pin actions/checkout, lycheeverse/lychee-action, and peter-evans/create-issue-from-file to immutable release commit SHAs
• reduce the workflow's contents permission from write to read
• prevent checkout from persisting credentials
• remove the GitHub token from Lychee and pass it only to the issue-creation action

Security impact

The workflow previously executed third-party actions from mutable branch/version references on push, schedule, and dispatch triggers with a write-scoped GITHUB_TOKEN. Compromise of an upstream mutable ref could therefore execute untrusted code with repository permissions (CWE-829). Because this workflow has no pull-request trigger, all configured executions can run in a write-token context.

This change preserves the existing triggers, preprocessing, link-check arguments, failure behavior, and automated issue reporting while reducing token exposure.

Pinned releases

• actions/checkout v3.7.0
• lycheeverse/lychee-action v2.9.0
• peter-evans/create-issue-from-file v6.0.0

Validation

• parsed the updated workflow as YAML
• verified each release tag resolves to the pinned full commit SHA
• confirmed no mutable action references remain in the workflow
• confirmed the diff contains only workflow hardening changes

[learn-build-service-prod]

Learn Build status updates of commit 1d08043:

✅ Validation status: passed

File	Status	Preview URL	Details
.github/workflows/linkvalidator.yml	✅Succeeded

For more details, please refer to the build report.

[learn-build-service-prod]

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.