- Updates to latest versions for all actions
- Pin actions not maintained by GitHub under `github.com/action` to exact
commit hashes. This is good practice for security, since tags can be
moved and then arbitray new code may execute. Since updating commit
hashes is slightly more hassle, the trade-off made here is to trust
GitHub, but not third-party actions.
This should also solve the warnings about Node.js 16 actions being
deprecated that is currently visible on the log page when docs.yml
is executed.
Ralf Gommers
Martin Kroeker
Matthew Barber