Update main.yml to explain use of SHA tags in workflow

[amshamah419]

Status

Ready

Related Issues

fixes: internal discussion FYI @kobymeir @sapirshuker

Description

This update pins the GitHub Action by commit SHA instead of a version tag. This approach ensures deterministic builds by preventing issues caused by tag changes or retagging in the upstream repository.

How to Bump the Version

To update to a newer version of the Action:

• Go to the Action’s repository on GitHub (e.g., actions/checkout).
• Navigate to the Commits tab.
• Copy the SHA of the desired commit.
• Replace the existing SHA in the workflow file (e.g., uses: actions/checkout@).
• Commit and push your changes.

Using a SHA ensures you always get the exact same code. You can update the SHA at any time to pull in changes as needed.

Must have

• Unit Test or Example Code
• Changelog entry - Infra related, not necessary at this time