The CI workflow has been updated to pin GitHub Actions to their full commit IDs rather than version tags, which secures the CI environment against potential supply-chain attacks. * tb/ci-pin-actions: ci: pin actions in the main workflow to full commit IDs