Pin Actions to commit SHAs

Hi 👋

I noticed the workflows reference Actions using version tags (e.g. actions/checkout@v4) rather than full commit SHAs.

Would you be open to pinning them to specific SHAs? This can help with certain automated security checks (e.g., OpenSSF Scorecard).

I’d be happy to open a PR updating the workflows accordingly.

Thanks!