ci: pin actions versions with hashes

[mdevolde]

ci: pin actions versions with hashes

I have pinned the versions of the actions used in the workflows with hashes.

Pinning GitHub Actions to a commit hash is an effective safeguard against supply chain attacks. By referencing a specific and immutable version of an action, you prevent compromised versions from being automatically integrated into your pipelines.

Because I bumped versions of some actions, I checked the breaking changes in the involved actions, and our workflows are not concerned by these breaking changes.

Here is the link to the tags for the actions I've pinned, if you want to check the hashes:

• https://github.com/actions/checkout/releases/tag/v6.0.3
• https://github.com/actions/setup-java/releases/tag/v5.2.0
• https://github.com/softprops/action-gh-release/releases/tag/v3.0.0

Pinning versions requires some maintenance, as you must perform manual upgrades regularly. However, in your case, with workflows that handle secrets (such as secrets.KEYSTORE or secrets.PROPERTIES), it’s a best practice to avoid trouble.