Pin commit hash of github actions to avoid supply chain attacks

[Yang-33]

Changes

To avoid supply chain attacks, specify actions in GitHub Actions workflows using commit hashes instead of version numbers. Pinact-action will fail the CI job if this is not done. Renovate already supports updates in the commit hash state, so there is no issue.

References

• https://github.com/suzuki-shunsuke/pinact-action
  • does pinact-action verify the checksum of the version of aqua it is using? Yes!:
• https://github.com/suzuki-shunsuke/pinact

Other repositories

• line/line-bot-sdk-python Pin commit hash of github actions to avoid supply chain attacks line-bot-sdk-python#772
• line/line-bot-sdk-php Pin commit hash of github actions to avoid supply chain attacks #680
• line/line-bot-sdk-nodejs Pin commit hash of github actions to avoid supply chain attacks line-bot-sdk-nodejs#1201
• line/line-bot-sdk-java Pin commit hash of github actions to avoid supply chain attacks line-bot-sdk-java#1576
• line/line-bot-sdk-go Pin commit hash of github actions to avoid supply chain attacks line-bot-sdk-go#555
• line/line-bot-sdk-ruby Pin commit hash of github actions to avoid supply chain attacks line-bot-sdk-ruby#405
• line/line-openapi Pin commit hash of github actions to avoid supply chain attacks line-openapi#90

[Yang-33]

TODOs

• Aait for internal auther's reply(failure reason is that example directory contains workflow)
  • Delete examples/KitchenSink/.github/workflows/workflow.yml #681
• Add pinact job as required job
• Merge this change