fix: pin upload-release-action to a commit sha (#444)

svenstaro/upload-release-action was referenced by tag, the only non-SHA
pin left in action.yml - actions/setup-go and anchore/scan-action were
already pinned by commit.

That made this action unusable for any consumer whose organisation
requires full-length SHA pins. The requirement is applied to every action
a composite action references, transitively, and GitHub resolves them all
during job setup, before any step's if: is evaluated. So the reference
failed consumers that never set release-dir and never reach this step,
and it failed as a startup_failure with no step logs, which is hard to
attribute to an upstream dependency.

Refs #443.

Author: jors0n

action.yml

@@ -317,12 +317,19 @@ runs:
     #
     # Upload binaries to release
     #
+    # Pinned by commit SHA, like every other action referenced here. An
+    # organisation action policy can require full-length SHA pins, and it is
+    # applied to every action a composite action references, transitively:
+    # GitHub resolves them all during job setup, before any step's `if:` is
+    # evaluated. A tag ref here therefore failed consumers that never release a
+    # binary and never reach this step, as an unexplained `startup_failure` with
+    # no step logs. See issue #443.
     - name: Upload binaries to release
       if: |
         github.event_name == 'push' &&
         contains(github.ref, 'refs/tags/') &&
         inputs.release-dir != ''
-      uses: svenstaro/upload-release-action@2.11.5
+      uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
       with:
         repo_token: ${{ inputs.token }}
         file: build/${{ inputs.release-type }}/${{ inputs.release-application-name }}/${{ inputs.release-architecture }}/main