Increase repo security by pinning actions to a commit SHA.

.github/workflows/docker-image.yml

@@ -1,3 +1,14 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# GitHub recommends pinning actions to a commit SHA.
+# To get a newer version, you will need to update the SHA.
+# You can also reference a tag or branch, but the action may change without warning.
+
+# Build a Docker image whenever it is pushed to master
+
 name: Docker Image CI
 
 on:
@@ -13,6 +24,6 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
     - name: Build the Docker image
       run: docker build --pull . -f Dockerfile -t pairdrop