ci: pin actions/checkout to its commit hash (#517)

Author: MickaelCa

.github/workflows/deploy-pr.yml

@@ -32,7 +32,7 @@ jobs:
           repositories: '${{ env.FLUX_REPO }}'
 
       - name: Checkout Flux repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: '${{ env.FLUX_OWNER }}/${{ env.FLUX_REPO }}'
           token: '${{ steps.app-token.outputs.token }}'
@@ -120,7 +120,7 @@ jobs:
           repositories: '${{ env.FLUX_REPO }}'
 
       - name: Checkout Flux repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: '${{ env.FLUX_OWNER }}/${{ env.FLUX_REPO }}'
           token: '${{ steps.app-token.outputs.token }}'

.github/workflows/docker-build.ecr.yml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
 

.github/workflows/release-please.yml

@@ -12,7 +12,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Create GitHub App token
         uses: actions/create-github-app-token@v2

.github/workflows/scorecard.yml

@@ -27,7 +27,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false