Pin GitHub Actions to Commit SHAs

You are helping the user migrate their GitHub Actions workflows from tag-based references (e.g., actions/checkout@v4) to commit SHA-pinned references with version comments (e.g., actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.7).

This prevents supply-chain attacks where a tag can be moved to point to malicious code.

Step 1: Discover Workflows and Current State

1. Find all workflow files:

   find .github/workflows -name '*.yml' -o -name '*.yaml'