Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build.yaml:
- Line 60: Replace all reusable workflow references that currently use the
mutable suffix "@main" with immutable commit SHAs for reproducible CI: update
the occurrences referencing conda-cpp-build.yaml, conda-python-build.yaml,
conda-upload-packages.yaml, custom-job.yaml, wheels-build.yaml, and
wheels-publish.yaml so each "uses: rapidsai/shared-workflows/...@main" becomes
"uses: rapidsai/shared-workflows/...@<commit-sha>" (choose and insert the
appropriate immutable SHA for each referenced workflow); ensure every repeated
reference to the same workflow file is pinned consistently and commit the
change.

In @.github/workflows/pr_issue_status_automation.yml:
- Line 16: The reusable workflow reference uses a mutable `@main` ref which is
insecure for a privileged pull_request_target workflow (the problematic line is
the uses:
rapidsai/shared-workflows/.github/workflows/project-get-item-id.yaml@main);
update that ref to an immutable commit SHA or a release tag (e.g., replace `@main`
with @<commit-sha>), and verify the workflow still receives
ADD_TO_PROJECT_GITHUB_TOKEN correctly; apply the same pinning approach to other
rapidsai/shared-workflows references across workflows to fully remediate the
supply-chain risk.

In @.github/workflows/trigger-breaking-change-alert.yaml:
- Line 16: The reusable workflow reference currently uses a mutable ref
"rapidsai/shared-workflows/.github/workflows/breaking-change-alert.yaml@main";
replace the mutable "@main" with an immutable full commit SHA (40 hex chars) of
the target repo to pin the workflow, i.e., update the `uses` value to
"rapidsai/shared-workflows/.github/workflows/breaking-change-alert.yaml@<commit-sha>"
(obtain the SHA from the remote repo or a trusted commit) so the
`pull_request_target` run cannot be changed by updates to main.

---

Outside diff comments:
In @.github/workflows/pr.yaml:
- Around line 711-720: The workflow references undefined inputs (inputs.branch,
inputs.date, inputs.sha) in the job using
rapidsai/shared-workflows/.github/workflows/custom-job.yaml@main; replace these
push-only invalid expressions with appropriate GitHub context values: use
github.ref_name (or extract branch from github.ref) instead of inputs.branch,
use github.sha instead of inputs.sha, and use github.event.head_commit.timestamp
(or github.run_id/github.run_number if preferred) instead of inputs.date; update
the with: block entries for branch, date, and sha accordingly so the job runs
under push triggers without undefined inputs.