Consolidate versions of GitHub Actions

[Flash0ver]

Description

Currently, our GitHub Actions - uses mixed @{TAG_NAME} and @{COMMIT_SHA}.

Verified Actions and Sentry-maintained Actions may be by tag,
but ideally, we use the Commit-SHA everywhere,
for both security and reproducibility.

[linear]

NET-457 Consolidate versions of GitHub Actions

[alexsohn1126]

Doesn't seem too difficult... I'll take a look at this!

[jamescrosswell]

but ideally, we use the Commit-SHA everywhere, for both security and reproducibility.

@Flash0ver what's the practical difference? A tag should simply be an alias/label for a particular commit anyway right? Are we worried about people moving these around (delete a tag from one commit and reusing it on another)? I don't think we've ever had a problem with this, so it seems like more of a theoretical concern.

Looking at @alexsohn1126's PR, the downside to this is that commit hashes are less readable:

And it's easy to make mistakes that reviewers don't pick up on:

action@e468171a9de216ec08956ac3ada2f0791b6bd435 # tag: v6

Is that really the commit sha for v6? Would a reviewer check all of the commit hashes in a PR to ensure the tag referenced in the accompanying comment matches the sha? And if the tag has been deleted and reapplied to a new sha, how would the reviewer know?

I prefer using the tags personally.

[alexsohn1126]

If readability is a major issue, we can move the common Actions we use such as checkout into its separate file. We can have a file in .github/actions/checkout/action.yml

and have the content be like:

name: Checkout (pinned)
description: Uses actions/checkout pinned to a specific commit
runs:
  using: composite
  steps:
    - uses: actions/checkout@<FULL_SHA>

Then when we use it do something like:

- name: Checkout
  uses: ./.github/actions/checkout

So we have one source of truth (commit SHA) for all of these usages.

In my opinion, we should be aware of supply chain attack vectors especially with what happened with NPM this month ...