Context

Follow-up from PR #1379 (SHA staleness validator). The Test-PSModulePins.ps1 checker now flags any Install-Module PSScriptAnalyzer call missing a -RequiredVersion pin. Across the repo's GitHub Actions workflows, ~9 install sites currently install PSScriptAnalyzer without a pinned version.

Scope

• Audit all .github/workflows/*.yml install sites for PSScriptAnalyzer.
• Add -RequiredVersion 1.25.0 (matching the manifest entry in scripts/security/tool-checksums.json) to each call.
• Verify npm run lint:version-consistency and Test-PSModulePins.ps1 are clean afterward.

Acceptance Criteria

• All workflow install sites pin PSScriptAnalyzer to the manifest-declared version.
• Supply-chain pin checker exits 0 with no warnings for PSScriptAnalyzer.
• A single follow-up PR scoped only to this hardening sweep.

References

• PR feat(security): add PSGallery staleness check and BOM cleanup #1379 review thread: feat(security): add PSGallery staleness check and BOM cleanup #1379 (comment)
• Manifest: scripts/security/tool-checksums.json