fix: pin GitHub Actions to SHA for supply chain security (#16)

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Author: riccardosarro

.github/workflows/go.yml

@@ -10,13 +10,13 @@ jobs:
         goversion: ["1.24", "1.25"]
     steps:
       - name: Set up Go ${{matrix.goversion}} on ${{matrix.os}}
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
         with:
           go-version: ${{matrix.goversion}}
         id: go
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
 
       - name: gofmt
         run: |