SHA pinning GitHub Actions across an organization (semgrep.dev)

Disclosure: I work at Semgrep but figure other engineers may find the approach we used interesting.

It's crazy to me is that the Github API for this is so nascent for something that has such a large attack surface. E.g., even if you pin your actions directly, there's still no equivalent of an action lockfile* so all the transitives are still unpinned.

*(I think Github said this is on the roadmap a few months ago)