Pins github actions references to hardcoded hashes

pin-gh-action-version-to-sha.sh

#!/usr/bin/env bash

# a cache to keep already discovered refs
declare -A refs

for action in $(rg --no-filename 'uses: ' .github/workflows action.y*ml | sed -e '/^$/d' -e '/\.\//d' -e 's/.*uses: //'); do
  repo=$(awk <<<"${action}" -F@ '{print $1}')
  ref=$(awk <<<"${action}" -F@ '{print $2}')

  if [[ ${refs["${action}"]} != "" ]]; then
    continue
  fi

  # get the new ref from github
  dst_ref=$(gh api repos/${repo}/commits/${ref} --template '{{.sha}}')

  refs["${action}"]="$dst_ref"
done

for action in ${!refs[@]}; do
  repo=$(awk <<<"${action}" -F@ '{print $1}')
  src_ref=$(awk <<<"${action}" -F@ '{print $2}')

  dst_ref="${refs["${action}"]}"

  find .github/workflows -iname '*.yml'  -o -iname '*.yaml' | xargs sed -i "s!${action}!${repo}@${dst_ref}!" action.y*ml
done