pin github actions by digest instead of tag

[bobcallaway]

Addressing https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies

data from running scorecard --show-details --repo=https://github.com/sigstore/fulcio/ --checks Pinned-Dependencies --format json:

{
  "date": "2022-01-12",
  "repo": {
    "name": "github.com/sigstore/fulcio",
    "commit": "d890471d80472171effea2ce5a77941d351d2bbe"
  },
  "scorecard": {
    "version": "61a0124",
    "commit": "61a01244078b61abf5a2cdced8961927661edb8c"
  },
  "score": 2,
  "checks": [
    {
      "details": [
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/codeql-analysis.yml:38",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/codeql-analysis.yml:42",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/codeql-analysis.yml:46",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/codeql-analysis.yml:48",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/main.yml:29",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/main.yml:32",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/verify-k8s.yml:25",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/verify-k8s.yml:26",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/verify-k8s.yml:59",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/verify-k8s.yml:60",
        "Warn: third-party action not pinned by hash: .github/workflows/verify-k8s.yml:64",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/verify-k8s.yml:286",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/verify.yml:25",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/verify.yml:26",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/verify.yml:41",
        "Warn: third-party action not pinned by hash: .github/workflows/verify.yml:45",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/verify.yml:55",
        "Warn: GitHub-owned action not pinned by hash: .github/workflows/verify.yml:56",
        "Warn: docker image not pinned by hash: Dockerfile:16",
        "Warn: docker image not pinned by hash: Dockerfile:31",
        "Warn: docker image not pinned by hash: Dockerfile:39",
        "Warn: docker image not pinned by hash: Dockerfile.ctfe_init:16",
        "Warn: go installation not pinned by hash: Dockerfile:40",
        "Warn: go installation not pinned by hash: Dockerfile.ctfe_init:20",
        "Info: no insecure (not pinned by hash) dependency downloads found in shell scripts",
        "Warn: go installation not pinned by hash: .github/workflows/verify-k8s.yml:31",
        "Warn: go installation not pinned by hash: .github/workflows/verify.yml:31"
      ],
      "score": 2,
      "reason": "dependency not pinned by hash detected -- score normalized to 2",
      "name": "Pinned-Dependencies",
      "documentation": {
        "url": "https://github.com/ossf/scorecard/blob/61a01244078b61abf5a2cdced8961927661edb8c/docs/checks.md#pinned-dependencies",
        "short": "Determines if the project has declared and pinned its dependencies."
      }
    }
  ],
  "metadata": null
}

This also updates references to set a consistent Go version based on the value in Dockerfile.

Signed-off-by: Bob Callaway bob.callaway@gmail.com

Summary

Ticket Link

Fixes

Release Note

[haydentherapper]

This might have broken something - See a recent PR like #320 for the failing test

[bobcallaway]

This might have broken something - See a recent PR like #320 for the failing test

checking it now