CI : Pin github actions to full commit SHA

[Aniketsy]

https://github.com/microsoft/onnxscript/blob/main/.github/workflows/main.yaml#L122

currently we're using mutable tags in our workflow, i think we can pin full commit SHA (as it guards supply chain attacks).

Please let me know your thoughts on this. Thanks!

[justinchuby]

These are trusted publishers (GitHub). So I think we are ok?

[Aniketsy]

These are trusted publishers (GitHub). So I think we are ok?

maybe yes, but we can say pinning full commit is kind of good practice and most of other repository are using, so i think we should also use, but if not i'm happy to close this issue. Thanks!

[justinchuby]

I’d be happy either way. Contribution appreciated!

[SwethaShankarV]

Hi @Aniketsy, are you currently working on a PR for this? If not, I'd love to take it on!

[Aniketsy]

@SwethaShankarV yes, i was working and i'll open PR shortly . Thanks :)

[Aniketsy]

@justinchuby maybe as a follow up we can also implement Zizmor (https://github.com/zizmorcore/zizmor) . In Scipy we already have and there are chances to have discussion for the numpy in upcoming dev meeting . Please let me know if you have any plans for this. Thanks :)