[ci] Pins github action commit hash

[chunhtai]

as title. This is required due to our policy

context: flutter/flutter#179033

Pre-Review Checklist

• I read the Contributor Guide and followed the process outlined there for submitting PRs.
• I read the Tree Hygiene page, which explains my responsibilities.
• I read and followed the relevant style guides and ran the auto-formatter.
• I signed the CLA.
• The title of the PR starts with the name of the package surrounded by square brackets, e.g. [shared_preferences]
• I linked to at least one issue that this PR fixes in the description above.
• I updated pubspec.yaml with an appropriate new version according to the pub versioning philosophy, or I have commented below to indicate which version change exemption this PR falls under¹.
• I updated CHANGELOG.md to add a description of the change, following repository CHANGELOG style, or I have commented below to indicate which CHANGELOG exemption this PR falls under¹.
• I updated/added any relevant documentation (doc comments with ///).
• I added new tests to check the change I am making, or I have commented below to indicate which test exemption this PR falls under¹.
• All existing and new tests are passing.

If you need help, consider asking for advice on the #hackers-new channel on Discord.

Note: The Flutter team is currently trialing the use of Gemini Code Assist for GitHub. Comments from the gemini-code-assist bot should not be taken as authoritative feedback from the Flutter team. If you find its comments useful you can update your code accordingly, but if you are unsure or disagree with the feedback, please feel free to wait for a Flutter team member's review for guidance on which automated comments should be addressed.

Footnotes

1. Regular contributors who have demonstrated familiarity with the repository guidelines only need to comment if the PR is not auto-exempted by repo tooling. ↩ ↩² ↩³

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[stuartmorgan-g]

LGTM, but could you also add all the new workflow scripts here? I forgot about it before, but was reminded by the flake in expensive tests on this PR; adding them to the ignore list will avoid that problem for future PRs (although not this one since tool changes trigger all tests too).

[chunhtai]

Hi @stuartmorgan-g , do you think we should add the entire .github/workflows/* into the ignored this?

[stuartmorgan-g]

I was trying to be as conservative as possible (per the comment a few lines up from where I linked), but I think doing a path.startsWith('.github/workflows/') should be safe enough.

[stuartmorgan-g]

LGTM. Sorry for the delay, I didn't notice that you'd requested a re-review.