Update GitHub Actions to latest stable versions and add skills

[Copilot]

Bump all GitHub Actions in workflow files to their latest stable major versions.

• actions/checkout v4 → v6
• actions/setup-node v4 → v6
• actions/setup-python v4/v5 → v6
• actions/setup-go v5 → v6
• actions/github-script v5/v7 → v9
• golangci/golangci-lint-action v8 → v9

Actions already at latest (upload-artifact@v4, stale@v10, devcontainers/action@v1, setup-terraform@v3) were left unchanged.

[Copilot]

Pull request overview

This PR updates the repository’s GitHub Actions workflow dependencies by bumping referenced actions to newer major versions across CI, linting, governance, and release workflows.

Changes:

• Bumped actions/checkout, actions/setup-node, actions/setup-go, and actions/setup-python major versions in multiple workflows.
• Updated actions/github-script usages to v9 across workflows that rely on JavaScript helper scripts.
• Updated golangci/golangci-lint-action to v9 in the Go lint workflow.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/vscode-ci.yml	Bumps checkout/setup-node and github-script used by VS Code extension CI.
.github/workflows/validate-go-version.yml	Bumps checkout version for the Go version consistency check.
.github/workflows/schema-ci.yml	Bumps checkout/setup-node and setup-python for schema validation CI.
.github/workflows/pr-governance.yml	Bumps checkout and github-script for PR governance automation.
.github/workflows/lint-go.yml	Bumps checkout and golangci-lint action major versions.
.github/workflows/lint-bicep.yml	Bumps checkout version for Bicep lint workflow.
.github/workflows/ext-registry-ci.yml	Bumps checkout version for extension registry CI workflow.
.github/workflows/eval-unit.yml	Bumps checkout/setup-go/setup-node/setup-python for eval unit test workflow.
.github/workflows/devops-ext-ci.yml	Bumps checkout/setup-node for Azure DevOps extension CI.
.github/workflows/devcontainer-feature-test.yml	Bumps checkout for devcontainer feature test workflows.
.github/workflows/devcontainer-feature-release.yml	Bumps checkout for devcontainer feature release workflow.
.github/workflows/cspell-misc.yml	Bumps checkout/setup-node for misc spellcheck workflow.
.github/workflows/cspell-ext.yml	Bumps checkout/setup-node for extension spellcheck workflow.
.github/workflows/copilot-setup-steps.yml	Bumps checkout/setup-node for Copilot coding agent environment setup.
.github/workflows/cli-ci.yml	Bumps checkout/setup-node for CLI CI and misc checks.
.github/workflows/approval-ext-azure-ai-agents.yml	Bumps checkout and updates github-script reference for approval gate workflow.

[jongio]

Version bumps all check out - confirmed v6 exists for checkout/setup-node/setup-python/setup-go, and v9 exists for github-script and golangci-lint-action.

Checked the scripts in .github/scripts/ for compatibility with github-script@v9 (which drops require('@actions/github') support). All scripts use the standard injected {github, context, core} pattern, so no breakage expected there.

One concern flagged inline: the SHA pin removal in the approval gate workflow.

[vhvb1989]

It would be nice if you can create one skill in the repo to check if any of these needs update and doing and update

[wbreza]

Clean dependency update — looks good. A couple of minor observations to supplement existing reviews:

1. Pinning style inconsistency (low): approval-ext-azure-ai-agents.yml uses SHA pinning for github-script (@3a2844b7…) while pr-governance.yml and vscode-ci.yml use tag pinning (@v9). Pre-existing, but could be normalized in a follow-up.

2. Completeness (info): 16/23 workflows updated. The 5 lint-ext-*.yml files are covered transitively via lint-go.yml. Worth confirming event.yml doesn't need a checkout bump as well.

jongio's compatibility verification for github-script@v9 checks out — all scripts use the standard injected {github, context, core} pattern.

[jongio]

SHA pin restored on the approval gate workflow. All version bumps verified, scripts compatible with github-script v9.

[hemarina]

@copilot Check if event.yml need a checkout bump as well.

[Copilot]

@copilot Check if event.yml need a checkout bump as well.

event.yml does not use actions/checkout — it only uses azure/azure-sdk-actions@main. No bump needed there.

[jongio]

The latest commit reverts the SHA pin that was just added to address my previous feedback. This contradicts the tool-version-upgrade SKILL.md updated in the same push, which says 'Never demote a SHA pin to a bare tag' and cites this exact file as a supply-chain hardening example.

[trangevi]

Approved for agents

[wbreza]

Re-review after commit 5 ("add skills")

The original workflow version bumps (commits 1–4) remain clean — my prior APPROVE still stands for those changes.

New observations on commit 5:

1. Scope expansion (medium): Commit 5 adds a substantial rewrite of .github/skills/tool-version-upgrade/SKILL.md (+280/−14 lines), documenting GitHub Actions as a new supported tool category. This is a significant addition not reflected in the PR description — consider updating the body to cover this.

2. Separate concern (low): The SKILL.md documentation rewrite is a distinct change from the workflow bumps. For cleaner review history, this could have been a separate PR, but it's not blocking.

3. Approval coverage (info): All three prior approvals (vhvb1989, wbreza, jongio) were submitted before commit 5. Worth confirming reviewers are aware of the expanded scope.

The SKILL.md content itself looks well-structured — covers SHA pin handling, YAML validation, inventory scanning, and PR templates for GitHub Actions upgrades.

[wbreza]

Re-approving after reviewing commit 5 ("add skills"). The SKILL.md expansion is well-structured and the workflow bumps remain clean. LGTM.

[hemarina]

/check-enforcer override