ci: pin external/untrusted github actions

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

.github/workflows/build.yml

@@ -43,7 +43,7 @@ jobs:
           file: ./coverage/coverage.txt
       -
         name: Expose GitHub Runtime
-        uses: crazy-max/ghaction-github-runtime@v1
+        uses: crazy-max/ghaction-github-runtime@94085cef04e835448ac610090128515e781b4939
       -
         name: Build binaries
         run: |
@@ -89,7 +89,7 @@ jobs:
       -
         name: GitHub Release
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@1e07f4398721186383de40550babbdf2b84acfc5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/e2e.yml

@@ -125,7 +125,7 @@ jobs:
       -
         name: Install k3s
         if: matrix.driver == 'kubernetes'
-        uses: debianmaster/actions-k3s@v1.0.3
+        uses: debianmaster/actions-k3s@b9cf3f599fd118699a3c8a0d18a2f2bda6cf4ce4
         id: k3s
         with:
           version: v1.21.2-k3s1