Hash pin ci.yml workflow

[joycebrum]

Issue #505

Example of success run with hash pin https://github.com/joycebrum/pycparser/actions/runs/5006562582

Hashes:

• 8e5e7e5ab8b370d6c329ec480221332ada57f0ab
• 57ded4d7d5e986d7296eab16560982c6dd7c923b

[eliben]

I don't understand -- is the concern here that an attacker will hijack the official actions/checkout action?

[joycebrum]

Yeah the attacker can hijack or tag rename any version if the action repo got compromised.

Although the actions are official they are also open source projects and unfortunatelly can be compromised as any other project could.

But it is important to noticed that this is just an extra precaution (since the token permission is already read only, no much harm could be done).

[eliben]

Thanks for the clarification. I think I'll prefer to keep it simple for now