Pin GitHub Actions

[maennchen]

Change

This PR pins all GH Actions to a specific commit sha.

All actions invocations are written as uses: [REPO]/[NAME]@[SHA] # [VERSION]. This is supported by dependabot and it will automatically create PRs with both the SHA and version change in the comment.

Reason

As seen with tj-actions/changed-files last week, any version (even if using a tag) can compromise a repository. The only way to prevent this, is to pin the version to a specific SHA.

This is also recommended by ScoreCard: https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies

Recommendation

This will potentially create a lot of dependabot update PRs with the current configuration. In the projects I maintain and pinned the dependencies, I added a grouping rule to reduce the noise:

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      github-actions:
        applies-to: version-updates
        patterns:
          - "*"

[josevalim]

💚 💙 💜 💛 ❤️