Describe the enhancement

Using pinned dependencies for repeatable builds is a common practice. Many dependency managers implement it by allowing engineers to edit a dependencies file using semver versions, and resolving those to a specific hash that is stored in a "lock file". However, GH Actions do not provide that distinction.

From https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies

For GitHub workflows, pin dependencies by hash. See main.yaml for example. To determine the permissions needed for your workflows, you may use StepSecurity's online tool by ticking the "Pin actions to a full length commit SHA".

This ^ type of recommendation ensures repeatable build but creates a maintenance burden. I am not even sure if dependabot will be able to upgrade GH workflows that pin actions to specific commits.

Is it possible to support an equivalent of the "lock file" for GH workflows?