A free solution to the GitHub Actions supply chain crisis

After major GitHub Actions supply chain attacks, commit SHA pinning is no longer optional. Here's how to manage it without losing Dependabot security alerts.