ci: pin external actions to exact commit SHA

[ngxson]

Overview

Pin actions to full commit SHA, except for:

• Official actions
• ggml-org actions

Requirements

• I have read and agree with the contributing guidelines
• AI usage disclosure: YES, it is a repetitive task, so I used AI. But I manually validated the output

[CISC]

Suggested change

	- uses: editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c # v2.2.0
	- uses: editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c # v2

We should comment what the old tag was rather than what the new hash points to.

[ngxson]

Suggested change

	- uses: editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c # v2.2.0
	- uses: editorconfig-checker/action-editorconfig-checker@d2ed4fd072ae6f887e9407c909af0f585d2ad9f4 # v2

In this case, do you think it's better to also pin to the exact commit of v2 tag? https://github.com/editorconfig-checker/action-editorconfig-checker/releases/tag/v2

[CISC]

No, the latest at this time is fine (and v2.2.0 upgrades this to Node 24, which is required soon).

[ngxson]

In that case, I think keeping v2.2.0 will be more clear, right? Release tag: https://github.com/editorconfig-checker/action-editorconfig-checker/releases/tag/v2.2.0 with commit editorconfig-checker/action-editorconfig-checker@840e866

Changing it to just v2 means we use the v2 tag, unfortunately it doesn't mean v2.*

[CISC]

Ah, ok, I just assumed it was like the other tags that gets bumped.