Unpinned action reference in `.github/actions`

[mfisher87]

Is this issue already tracked somewhere, or is this a new report?

• I've reviewed existing issues and couldn't find a duplicate for this problem.

Have you checked the status of Earthdata services?

• I've executed earthaccess.status() and both CMR and EDL returned 'OK'.

Current Behavior

In #1268 I didn't pin these, but should have. I need to update my tool https://github.com/mfisher87/gha-hashpinner to support discovering files in .github/actions, it currently only looks in .github/workflows.

Expected Behavior

Pinned to an immutable ref

Steps To Reproduce

Environment

GHA

Additional Context

Related alerts:

https://github.com/earthaccess-dev/earthaccess/security/code-scanning/2
https://github.com/earthaccess-dev/earthaccess/security/code-scanning/1