[Shaik Naseeruddin (NaseerDevops-1994)]

Overview/Summary

Fixes Azure/Azure-Landing-Zones#4287 (Azure/Azure-Landing-Zones#4287).

The accelerator's generated CI/CD workflow and composite-action templates referenced GitHub Actions by bare version tags on the deprecated Node 20 generation, which produces Node 20 deprecation warnings in generated pipelines. This updates each action to the current stable major and pins it to the full commit SHA with a version comment (matching this repo's existing convention).

Scope

Only the generated templates under alz/github/actions/{terraform,bicep,bicep-classic}/templates/ are changed (14 files). Dependabot github-actions and the repo's own workflow pins were already handled by #145, so they are intentionally not touched here.

Before -> after (version + SHA pin)

Action	Before	After
actions/checkout	@v4	@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
azure/login	@v2	@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
azure/powershell	@v2	@f5b8adcfff1904872c7b98d4012d4914d74b1a82 # v3.0.0
hashicorp/setup-terraform	@v3	@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
actions/upload-artifact	@v4	@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
actions/download-artifact	@v4	@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
actions/github-script	@v6	@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

Testing / verification

• 1:1 line swaps only: 14 files changed, 32 insertions / 32 deletions. No bare @vN tags remain in any template (verified recursively).
• Input compatibility checked against template usage for every action (artifact name/path; github-token/script using github.rest.*/context; terraform_wrapper/terraform_version; client-id/tenant-id/subscription-id/enable-AzPSSession; azPSVersion/inlineScript) - no removed or renamed inputs.
• These are intentional major bumps: the previous majors run on the deprecated Node 20, so bumping is required to clear the warnings reported in the issue.
• Local reusable .../.github/actions/*@main references are intentional self-references to the generated repo and are left unchanged.

As part of this Pull Request I have

• Read the contribution guide and ensured this PR is compliant
• Checked for duplicate pull requests
• Associated it with relevant issues for tracking and closure
• Ensured my branch is up-to-date with the latest changes in main
• Performed testing and provided evidence

[Shaik Naseeruddin (NaseerDevops-1994)]

Validation evidence (#4287)

The change is action-version-only (bare @vN -> pinned @<sha> # vX.Y.Z) in the generated templates, with input-compatibility verified per action. Validated by pointing the PowerShell module at the local bootstrap module, focused on what the change affects:

1. Render proof - rendered the Terraform & Bicep CI/CD templates (templatefile); both produce valid workflow YAML with the pinned SHAs, fully resolved (0 leftover template vars).

2. Action-run proof - ran the updated actions on GitHub-hosted runners (both accelerator paths):

Accelerator	Actions executed green
Terraform	checkout v7.0.1, setup-terraform v4.0.1, upload-artifact v7.0.1, download-artifact v8.0.1, github-script v9.0.0
Bicep	checkout v7.0.1, azure/login v3.1.0, azure/powershell v3.0.0 (OIDC)

• github-script confirmed running on Node v24.19.0; azure/powershell authenticated successfully via OIDC.
• All 7 updated actions are runs.using = node24 - none on the deprecated Node 20 (the issue root cause). Independently verifiable via each action's action.yml at the pinned SHA.
• No Node 20 Actions-deprecation warnings observed.

Screenshots below are from a throwaway validation repo.