Hey, it's Pedro (see #2245) and I'm back with a new security suggestion!

When developing with CI workflows, it's common to version-pin dependencies (i.e. `actions/checkout@v3`). However, version tags are mutable, so a malicious attacker could overwrite a version tag to point to a malicious or vulnerable commit instead.

Pinning workflow dependencies by hash ensures the dependency is immutable and its behavior is guaranteed.

These hashes can be automatically updated by dependabot. Whenever new versions Actions are released, you'll receive a single PR updating all of their hashes and version comments at once (see [this example](https://github.com/pnacht/libarchive/pull/1)).

I'll send a PR pinning the Actions along with this issue.
Hash-pin workflow GitHub Actions
This is a GitHub Issue
repo:wabt
owner:WebAssembly
Title : Hash-pin workflow GitHub Actions
Issue date:

--- start body ---
Hey, it's Pedro (see #2245) and I'm back with a new security suggestion!

When developing with CI workflows, it's common to version-pin dependencies (i.e. `actions/checkout@v3`). However, version tags are mutable, so a malicious attacker could overwrite a version tag to point to a malicious or vulnerable commit instead.

Pinning workflow dependencies by hash ensures the dependency is immutable and its behavior is guaranteed.

These hashes can be automatically updated by dependabot. Whenever new versions Actions are released, you'll receive a single PR updating all of their hashes and version comments at once (see [this example](https://github.com/pnacht/libarchive/pull/1)).

I'll send a PR pinning the Actions along with this issue.
--- end body ---

The issue suggests a security improvement for GitHub Actions workflows by recommending the use of hash-pinning for dependencies instead of version tags. This practice mitigates the risk of dependency confusion attacks where a malicious actor could overwrite a version tag to point to a harmful commit. While this is a valuable security suggestion, it does not indicate an existing vulnerability in the codebase itself.