These are my GitHub Actions Workflows. There are many like them, but these are mine.
Caution
You may not want to use these workflows directly, rather use them as inspiration. GitHub provides documentation on their site Reuse Workflows on how to do so.
There is quite a bit of duplication across repositories. I'm certain there is likely a pattern or a tool or tools to manage this. This may be that, or may simply be a part of that. But this is an attempt to try and create a source of truth for GitHub Actions Workflows across my repositories. When I make updates here, they have the opportunity to trickle down to the other projects.
tl;dr: Tags mutable. SHA's are not.
Here is an article that explains it better, in more depth https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash.