CI: update actions

[dnicolodi]

Follow best practices and switch to pinning actions by commit hash rather than by major version number.

[dnicolodi]

This patch has been generated with this thing https://github.com/dnicolodi/update-github-actions

I always thought that things like dependabot are more of a liability than a resource and I wondered how difficult it would be to write a script that does the same thing locally. Turns out it is quite easy and I am very surprised that something similar does not exist yet. This implementation is very crude, but it works.

[eli-schwartz]

Follow best practices and switch to pinning actions by commit hash rather than by major version number.

The flop [sic] side of this is that in exchange for getting rid of the possibility that a GitHub.com Inc owned and operated repository has its tags maliciously retagged to point to malicious contents, you have added the possibility that the commit sha1 hash points to completely arbitrary (malicious) contents from a fork. Any and every sha1 commit pinned action has to be manually reviewed, independently, by:

• people who author a PR,
• people who merge a PR,
• people who fork the repo and want to enable actions in their fork,
• people who want to locally run the CI using tooling such as act,
• people who browse the repo and want to know how safe it and the artifacts it creates are

"Best practices" isn't simply carrying a lot of weight in that sentence, it's outright something that opinionated people disagree whether it is best practices or worst practices.

I fall into the latter camp, and have been known to accuse the OpenSSF of being an extractive corporate-motivated drain on the FOSS community precisely over this.