odin-269: use explicit shas for public github actions

odin-269: use explicit shas for public github actions #17