This pins every third-party action in our workflows to a full commit
SHA, keeping the resolved version tag as a trailing comment. Renovate
understands that convention and updates the SHA and comment together.
The trigger: yesterday the `v11` tag of `EndBug/add-and-commit` moved to
the broken v11.1.0 release, whose `action.yml` fails to load
(`Unrecognized named-value: 'github'`), which killed our publish
workflow ([failed
run](https://github.com/apify/crawlee/actions/runs/32255557318)). With
SHA pins, a tag moving under us, by accident or by compromise, can't
break or hijack CI anymore. `EndBug/add-and-commit` is pinned to
v11.0.0, the last working release; the upstream fix is pending in
EndBug/add-and-commit#783.
Own-org references (`apify/workflows`, `apify/actions`,
`apify/setup-apify-cli-action`) stay on floating refs on purpose, since
we control those repos.
Martin Adámek
d57a413371