build(.github): pin actions to commit-hash

[Fdawgs]

After what has been happening with tj-actions/changed-files over the past week this is probably a sensible idea.

@RafaelGSS even wrote about it a while back!

Checklist

• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[jsumners]

In my opinion, this one is good, but we don't need to use hashes on the GitHub owned actions.

[Fdawgs]

I did consider not using hashes for GitHub's official actions as they should (hopefully) be more secure than third-party actions, but official actions aren't immune from being compromised, so pinned them just to help me sleep better at night. 😄

[jsumners]

Not immune. But highly unlikely. I think the maintenance cost is too high to use hashes on GH maintained actions.

[Fdawgs]

Dependabot is active in this repo so it'll open PRs for updates for us.

[RafaelGSS]

FWIW dependabot and renovatebot automatically update those dependencies in the same way as git tags.

[Fdawgs]

FWIW dependabot and renovatebot automatically update those dependencies in the same way as git tags.

That's fine as this repo doesn't automerge dependabot updates, so someone will now need to manually review and merge, adding an extra layer of security. :)

[mcollina]

lgtm

[gurgunday]

lgtm if @jsumners is convinced, I feel like this trades convenience for security