Proposal: replace version based actions tags with commit SHAs instead

[kbdharun]

Currently, across all our actions across workflows use conventional tags i.e. actions/checkout@v4, etc which is overwritable and non-immutable leading to malicious use like:

• Security: temporary disabling of the codespell workflow due to malicious tj-actions/changed-files action #15946

Using commit SHA's like this actions/javascript-action@a824008085750b8e136effc585c3cd6082bd575f will be much more secure since it's immutable and is much more reliable than tags. Also, it's supported by dependabot too (which will add a comment about the semver version beside it)

i.e.

Checkout https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/using-pre-written-building-blocks-in-your-workflow#using-shas to know more.

---

GitHub is internally working on an immutable releases feature too from what I heard, which will enforce something similar IG.

[Managor]

Feels like no-brainer decision. I see no downsides.