sbojanic/ci improve security (#567)

* ci: replace tags with commit hashes

* docs: add tag name to comment

.github/workflows/ci.yml

@@ -32,10 +32,10 @@ jobs:
       matrix:
         python-version: ${{ fromJSON(needs.set_python_versions.outputs.all_versions) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #@v4
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #@v5
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -68,10 +68,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #@v5
         with:
           # build it on the minimum version
           python-version: ${{ fromJSON(needs.set_python_versions.outputs.all_versions)[0] }}
@@ -117,14 +117,14 @@ jobs:
     steps:
 
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #@v4
 
       - name: Get Upload URL
         id: get_upload_url
         run: echo "${{ github.event.release.upload_url  }}"
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #@v5
         with:
           # the newest python that we support
           python-version: ${{ needs.set_python_versions.outputs.last_version }}