Use commit sha in workflow actions

We should use the hashes rather than the tag names so they are immutable. This means we need an automated way of fetching the current sha, though. Or we alternatively keep them up to date manually in this repo (maybe through an automation?).