CI: update all gha actions

[andyfaff]

No description provided.

[andyfaff]

Updates made with gha-update package

[bmaranville]

Why use a hash instead of a version tag?

[andyfaff]

The gha-update package does hashes by default. Using a script is nice because it does all actions automagically.
Also hashes are more secure. If the action author makes a point release then if you're using something like v4 then you automatically start using that. If there's a security problem with that point release you're exposing the repo to that. If the repo permissions aren't locked down then that can create issues. By contrast hashes are fixed to a single version.
Using an updater script every so often seems like a good balance.

[bmaranville]

Good points... I try to stick mostly to actions provided directly by GitHub (where one might worry less about hijacked version tags) but it's also nice to offload some maintenance to gha-update

[bmaranville]

...though it seems like we're now trusting the gha-update package to not be malicious, instead

[andyfaff]

Sort of. You can check easily that youre not using a different action (unless there's a typosquat change). A single hash version is less likely to have a problem.

[andyfaff]

https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash