BAU: Ensure that actions are pinned to SHAs

see: https://gds-way.digital.cabinet-office.gov.uk/standards/source-code/using-github-actions.html#using-github-actions-and-workflows

Author: whi-tw

.github/workflows/require-pinned-github-actions.yml

@@ -0,0 +1,21 @@
+name: Ensure actions are pinned to SHAs
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - ready_for_review
+      - synchronize
+    paths:
+      - ".github/workflows/**.yml"
+      - ".github/workflows/**.yaml"
+
+jobs:
+  check-actions-sha:
+    name: Check actions are pinned to SHAs
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
+      - name: Ensure SHA pinned actions
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@9e9574ef04ea69da568d6249bd69539ccc704e74 # v4.0.0