[Gaudy Blanco (gaudyb)]

Description

Pin the remaining mutable GitHub Actions references to full-length commit SHAs so the maintenance workflows comply with Microsoft's action-pinning requirement before enforcement on December 4, 2026.

Also repair CI failures discovered during validation: notebook and smoke workflows referenced a stale API-key secret, and smoke-test graph extraction dropped chunks after Azure HTTP 429 responses because retries were not configured.

Related Issues

Addresses the GraphRAG mutable action reference warning. No linked GraphRAG issue.

Applies the same remediation approach as microsoft/benchmark-qed@7366a97.

Proposed Changes

• In .github/workflows/close-dependabot-prs.yml and .github/workflows/update-deps.yml, replace:
  • actions/checkout@v6 with actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 (v6.1.0).
  • oven-sh/setup-bun@v2 with oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 (v2.2.0).
• Preserve readable version comments and the existing Bun runtime version.
• Resolve each SHA against its upstream major tag and confirm its corresponding release tag.
• Use the rotated GRAPHRAG_API_KEY secret in notebook and smoke workflows, consistent with the documentation workflow.
• Configure bounded exponential-backoff retries for completion and embedding models in both active smoke fixtures. Authentication failures still propagate without retries.
• Run smoke tests when fixture files change.
• Increase the embedding timing budget from 150 to 400 seconds in both smoke fixtures to accommodate bounded retry waits, as approved by the maintainer.
• Keep all smoke-test row-count and data-quality thresholds unchanged.

Checklist

• I have tested these changes locally.
• I have reviewed the code changes.
• I have updated the documentation (if necessary).
• I have added appropriate unit tests (if applicable).

Additional Notes

No public API or documentation changes are necessary for these workflow and smoke-fixture configuration changes. Existing retry-configuration tests were run; no new unit tests were added. Live-service notebook and smoke tests are validated through GitHub Actions rather than using repository secret values locally.

The latest failed smoke run before adding retries completed indexing but logged 18 failed extraction chunks after Azure token-rate-limit responses. The CSV fixture produced 69 entities on Linux and 60 on Windows, below the required 100. Artifact inspection confirmed the other row-count and null checks passed for the Linux output. The fix addresses missing retries rather than lowering the required output quality.

Validation:

• git diff --check - passed.
• .venv/bin/python -m pytest tests/unit/config/test_retry_config.py -q - passed (2 tests).
• A focused runtime check loaded all four real fixture model configurations, constructed their configured retry policies, and confirmed recovery from a synthetic RateLimitError while immediately propagating AuthenticationError - passed.
• The following exact command - passed: parsed all 12 workflow YAML files and verified that all 35 action references use full 40-character commit SHAs.

ruby -ryaml -e 'files = Dir[".github/workflows/*.{yml,yaml}"]; count = 0; visit = lambda do |node, file|; case node; when Hash; node.each do |key, value|; if key == "uses"; count += 1; unless value.start_with?("./") || value.match?(%r{\A[^\s@]+/[^\s@]+@[0-9a-f]{40}\z}); abort "Unpinned action in #{file}: #{value}"; end; end; visit.call(value, file); end; when Array; node.each { |value| visit.call(value, file) }; end; end; files.each { |file| visit.call(YAML.load_file(file), file) }; puts "PASS: parsed #{files.length} workflows; all #{count} action references use full 40-character commit SHAs."'

[Gaudy Blanco (gaudyb)]

Follow-up CI fix: notebook tests failed with Azure OpenAI HTTP 401 authentication errors. Both notebook and smoke workflows mapped GRAPHRAG_API_KEY to the stale OPENAI_API_KEY secret (last updated in 2024). They now use the existing GRAPHRAG_API_KEY secret (updated October 21, 2026), consistent with the documentation workflow. No secret values were read or changed. Local YAML parsing, exact secret-mapping assertions, and git diff --check passed. GitHub CI is being rerun; this workflow change also causes the previously skipped smoke tests to execute.

[Gaudy Blanco (gaudyb)]

The rotated credentials work. Attempt 3 failed because Azure returned HTTP 429 token-rate-limit errors during graph extraction, not HTTP 401. The Linux artifact contains 18 failed extraction chunks; min-csv produced 69 entities on Linux and 60 on Windows versus the unchanged 100–750 requirement. Added bounded exponential-backoff retries to the completion and embedding models in both active smoke fixtures, and updated the path filter so fixture changes run smoke tests. Validation: .venv/bin/python -m pytest tests/unit/config/test_retry_config.py -q passed (2 tests); all four real fixture model configurations validated and recovered from a synthetic RateLimitError while propagating AuthenticationError without retries; git diff --check passed. CI is being rerun to validate actual service behavior.

[Gaudy Blanco (gaudyb)]

Retry-enabled CI now passes the CSV entity-count assertions on both platforms. Both remaining failures are the embedding timing budget: 252.82 seconds on Linux and 196.20 seconds on Windows versus 150 seconds. With maintainer approval, increased only that budget to 400 seconds in both smoke fixtures. Replayed the existing TestIndexer output-assertion method against the actual Linux CI artifact with the updated fixture configuration: all workflow coverage, timing, row-count, and null checks passed. All data-quality requirements remain unchanged. Pushed the timing adjustment for full CI validation.

[Gaudy Blanco (gaudyb)]

Final validation passed on commit 6a1d2d5: all PR checks are green. uv run poe test_smoke passed on Ubuntu and Windows (actual Smoke Test steps executed, not skipped): https://github.com/microsoft/graphrag/actions/runs/40911481004. uv run poe test_notebook also passed on both platforms: https://github.com/microsoft/graphrag/actions/runs/40911480981. Build/type checks, unit tests, integration tests, spellcheck, semver, and CodeQL all passed. The fix preserves all row-count/null/data-quality assertions and uses bounded retries plus the approved 400-second embedding budget.