Use full commit SHA in github action

Author: iannuzzelli

.github/workflows/python-package.yml

@@ -62,7 +62,7 @@ jobs:
           path: dist/
       - name: Push to pypi
         # if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@release/v1.13
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1.13
         with:
           user: __token__
           password: ${{ secrets.PYPI_API_TOKEN }}