[StepSecurity] ci: Harden GitHub Actions (#639)

Signed-off-by: StepSecurity Bot <[email protected]>

.github/workflows/tlpclear-githubpages.yml

@@ -49,7 +49,7 @@ jobs:
         run:  python -m mkdocs build --strict
       - name: build rss feeds
         run:  python generate_rss.py
-      - uses: stefanzweifel/git-auto-commit-action@v5
+      - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
         with:
           commit_message: Format markdown docs
       - name: Setup Pages