Update .github/workflows/codacy.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Misfit <218383634+JaclynCodes@users.noreply.github.com>

Author: JaclynCodes

.github/workflows/codacy.yml

@@ -40,6 +40,8 @@ jobs:
 
       # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
       - name: Run Codacy Analysis CLI
+        # Pinned to a specific commit SHA for security; update this SHA when bumping the Codacy action version.
+        # When updating, look up and note the corresponding release tag for this commit in Codacy's repository.
         uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b
         with:
           # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository