Previously versions were using tags. By pinning them to SHAs, it ensures the versions cannot be changed.
Also note that I used the latest release, so many of the actions received a version bump as part of this change.
This will provide clarity for someone looking at the secrets on the GitHub deployment admin screens. It will be clear that we have the upload key available to CI and not the final release key.
Carter Jernigan