Merge pull request #105 from vimeo/fix/github-action-sha-pinning

fix: pin GitHub Actions to SHA for supply chain security

Author: riccardosarro

.github/workflows/pr-checks.yaml

@@ -20,10 +20,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: ${{ matrix.php-versions }}
           tools: phpunit:${{ matrix.phpunit-versions }}