…487)

## Summary

Standardize the `actions:` sub-schema introduced in #479 by extracting
it into a dedicated top-level `action_mappings:` section, as proposed in
#483.

## Approach

Chose **Option B** from #483 — extract to a separate section. This keeps
artifact type definitions uniform (all follow the same
retention_days/description/compression_level pattern) while providing a
centralized place for action-to-artifact traceability.

## Changes

### `.github/artifact-retention.yml`
- **Removed** `actions:` block from `sbom_reports` artifact type
- **Added** top-level `action_mappings:` section mapping GitHub Actions
to their artifact types:

| Artifact Type | Actions |
|--------------|---------|
| `security_reports` | `github/codeql-action/analyze`,
`github/codeql-action/upload-sarif`, `ossf/scorecard-action`,
`actions/dependency-review-action` |
| `build_artifacts` | `actions/upload-artifact`,
`actions/attest-build-provenance` |
| `test_results` | `codecov/codecov-action` |
| `sbom_reports` | `anchore/sbom-action`, `actions/attest-sbom` |

All SHAs match the pins currently used in workflow files.

## Validation
- ✅ YAML lint passes
- ✅ `Test-DependencyPinning.ps1` — 100% compliance
- ✅ Pester tests — 47/47 passed

Closes #483

Depends on #479

🤖 I have created a release *beep* *boop*
---


##
[2.3.0](hve-core-v2.2.0...hve-core-v2.3.0)
(2026-02-13)


### ✨ Features

* **agents:** add GitHub backlog management pipeline
([#448](#448))
([2b4d123](2b4d123))
* **docs:** define inactivity closure policies for issues and PRs
([#452](#452))
([5e710fd](5e710fd))
* **extension:** implement collection-based plugin distribution system
([#439](#439))
([3156d98](3156d98))
* **instructions:** replace EVEN/ODD hardcoding with runtime milestone
discovery protocol
([#486](#486))
([ae95eb2](ae95eb2))
* **plugin:** support Copilot CLI plugin generation from collection
manifests ([#496](#496))
([e6cee85](e6cee85))
* **scripts:** enhance on-create.sh to install actionlint and PowerShell
modules ([#500](#500))
([67585f5](67585f5))


### 🐛 Bug Fixes

* **docs:** replace broken relative link with inline code reference
([#465](#465))
([8133b36](8133b36))
* **instructions:** prevent local-only paths from leaking into GitHub
issues ([#489](#489))
([497d2fe](497d2fe))
* **workflows:** prevent release-please infinite loop on main branch
([#470](#470))
([134bdd6](134bdd6))
* **workflows:** remove release-please skip guard that prevents tag
creation ([#511](#511))
([5e53271](5e53271))


### 📚 Documentation

* **agents:** add GitHub Backlog Manager documentation and agent catalog
([#503](#503))
([5e818ce](5e818ce))
* align CONTRIBUTING.md with docs/contributing/ guides
([#445](#445))
([73ef6aa](73ef6aa))


### ♻️ Refactoring

* **scripts:** refactor dev-tools and lib scripts to use CIHelpers
module ([#482](#482))
([fdf9145](fdf9145))
* **scripts:** standardize PowerShell entry point guard pattern
([#477](#477))
([6b84a8e](6b84a8e))


### 🔧 Maintenance

* **config:** standardize action mappings in artifact-retention.yml
([#487](#487))
([7927db2](7927db2))
* **deps-dev:** bump cspell from 9.6.2 to 9.6.4 in the npm-dependencies
group ([#461](#461))
([c788095](c788095))
* **deps:** bump actions/setup-python from 5.1.1 to 6.2.0 in the
github-actions group
([#462](#462))
([69ef3c9](69ef3c9))
* **security:** add SBOM artifact retention policy
([#479](#479))
([8031557](8031557)),
closes [#453](#453)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: hve-core-release-please[bot] <254602402+hve-core-release-please[bot]@users.noreply.github.com>