pin each github actions dep to a git commit hash