Expand github action pinning guidance to include update approach

[huwd]

SHA pinning is a sensible approach to mitigate potential supply chain attacks. See some great blog posts here on the approach:

https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash also
https://michaelheap.com/improve-your-github-actions-security/#using-pin-github-action

However one down side is that SHA's are not very human readable. It can be difficult to tell from the SHA if the version we've pinned has an update, or if that update is a security or important fix.

Best practice therefore is to place a comment after the pinned version listing the semantic version for a third party github action.

This gets you best of both worlds, maintainability plus certainty.

It might look at bit like this:

jobs:
  check-pull-request:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
	uses: actions/checkout@ee066bloop # pin @v2
      - name: Install Ruby uses:
	ruby/setup-ruby@22acsewblah # pin@v1

Consistency here also helps us manage this code in line with the GDS Way requirement to Update dependencies frequently when managing third party dependencies:
https://gds-way.digital.cabinet-office.gov.uk/standards/tracking-dependencies.html#update-dependencies-frequently

Since October 2022 DependaBot will now look for comments on SHA pinning and automatically suggest updates. Similar approaches may be possible for other dependency management tools.

Dependabot currently supports a range of different comment syntaxses which can be viewed here:
dependabot/dependabot-core#5951 (comment)

I've tried to keep the guidance general and open, leaving detail to this commit history, given the range of different tools on use across GDS.

The principles are:

• Pin your actions using SHAs
• Ensure human readability by commenting the semver on the line with the action
• Explore if your usual dependency management process, especially automated ones like DependaBot can help flag and raise visibility on new versions.

Looks like

[willp-bl]

Looks good just needs a couple of minor changes.

[stephengrier]

This seems like a good change to me and is inline with what we're already doing in some places. I'm happy to approve when the comments are resolved.

[huwd]

Rightio folks,
Finally got this done, ready for a re-review if one of @andyloughran, @stephengrier, @willp-bl wouldn't mind another look?

Request for a re-review

[huwd]

Slight nudge here:
@andyloughran, @stephengrier, @willp-bl

Would anyone mind re-reviewing based on queries and resolutions above?

[heathd]

I think this has been reviewed by several people, the review comments have been acted on, so I'm happy for this to be merged in. Thanks Huw this looks like some valuable advice