chore: pin GH Actions to commit sha

rancher/rancher-security 1906

Signed-off-by: Derek Su <derek.su@suse.com>

Author: derekbit

.github/workflows/fossa.yml

@@ -20,13 +20,13 @@ jobs:
     # The FOSSA token is shared between all repos in Rancher's GH org. It can be
     # used directly and there is no need to request specific access to EIO.
     - name: Read FOSSA token
-      uses: rancher-eio/read-vault-secrets@main
+      uses: rancher-eio/read-vault-secrets@7282bf97898cd1c16c89f837e0bb442e6d384c89
       with:
         secrets: |
           secret/data/github/org/rancher/fossa/push token | FOSSA_API_KEY_PUSH_ONLY
 
     - name: FOSSA scan
-      uses: fossas/fossa-action@main
+      uses: fossas/fossa-action@edcc58279d396837acb02a1317ffa24dabfb7cc9
       with:
         api-key: ${{ env.FOSSA_API_KEY_PUSH_ONLY }}
         # Only runs the scan and do not provide/returns any results back to the

.github/workflows/sync-upstream.yml

@@ -13,7 +13,7 @@ jobs:
       with:
         persist-credentials: false
     - name: repo-sync
-      uses: rancher/gh-issue-mgr/github-sync@main
+      uses: rancher/gh-issue-mgr/github-sync@b70f0bdf12a03e5e3f33e4f92ccb6c89deb3ebd9
       with:
         source_repo: "https://github.com/longhorn/backing-image-manager.git"
         source_branch: "v*.*.x"