ci: lock 3rd party github actions to specific releases

Author: georgeRobertson

.github/workflows/ci_publish.yml

@@ -17,10 +17,10 @@ jobs:
           sudo apt -y install --no-install-recommends liblzma-dev libbz2-dev libreadline-dev
 
       - name: Install asdf cli
-        uses: asdf-vm/actions/setup@v4
+        uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47  # v4.0.1
 
       - name: Install software through asdf
-        uses: asdf-vm/actions/install@v4
+        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47  # v4.0.1
 
       - name: reshim asdf
         run: asdf reshim
@@ -56,4 +56,4 @@ jobs:
           path: dist/
 
       - name: publish
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0