GA-C002: Mutable action tag

Using a branch ref like @main or @master means the action version changes with every commit to that branch. This makes builds non-reproducible and exposes the workflow to untested or malicious changes. Pin to a commit SHA or at minimum a specific version tag.