fix(workflow): use commit SHAs (not tag-object SHAs) for action pinning

fix(workflow): use commit SHAs (not tag-object SHAs) for action pinning #94