Use version tags for 3rd party GH Actions

[stmcginnis]

This switches our third party GitHub Action references to use the major version tag rather than the SHA. This means the actions will automatically use the latest tag within that versions, and Dependabot updates will only be necessary when there is a major version bump where we will want to evaluate the included changes before updating.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: stmcginnis
Once this PR has been reviewed and has the lgtm label, please assign bentheelder for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[BenTheElder]

This switches our third party GitHub Action references to use the major version tag rather than the SHA. This means the actions will automatically use the latest tag within that versions, and Dependabot updates will only be necessary when there is a major version bump where we will want to evaluate the included changes before updating.

We used shas intentionally because it means that you have T.O.F.U. and you don't have any surprise changes. The dependabot PRs can be reverted, but we can't go revert their tag changes.

[stmcginnis]

I thought that might be the case. 👍

[BenTheElder]

@aojea might have other thoughts, but I think especially "we can trivially revert any issues" is worth it, even if we wind up with more dependabot PRs to review :-)

[aojea]

No strong opinion here, I always prefer pinned dependencies, I don't really had much issues with GitHub actions dependencies so I can't really say ... I expect them to be very stable

[BenTheElder]

I don't really had much issues with GitHub actions dependencies so I can't really say ... I expect them to be very stable

There's also the concern about effectively curl | bash into your CI infra (versus e.g. at least hash pinning) behind a mutable pointer. We currently don't allow github actions access to much but ...