diff --git a/.github/workflows/pr-project-board.yml b/.github/workflows/pr-project-board.yml
index 7af3ec269e..eb368efb8b 100644
--- a/.github/workflows/pr-project-board.yml
+++ b/.github/workflows/pr-project-board.yml
@@ -4,8 +4,7 @@ on:
   pull_request_target:
     types: [opened]
     paths:
-      - 'quickstarts/**'
-
+      - "quickstarts/**"
 
 env:
   GITHUB_TOKEN: ${{ secrets.OPENSOURCE_BOT_TOKEN }}
@@ -15,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
 
       - name: Move PR to Project Board for triage
         run: |
diff --git a/.github/workflows/preview-links.yml b/.github/workflows/preview-links.yml
index 2b40f9c103..37c0ff3cee 100644
--- a/.github/workflows/preview-links.yml
+++ b/.github/workflows/preview-links.yml
@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Create preview links
         id: links
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3725559044..fce88846b8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,14 +15,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         with:
           token: ${{ secrets.OPENSOURCE_BOT_TOKEN }}
           ref: "main"
           fetch-depth: 0
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Generate schema docs for GraphQl
         id: generate-schema
@@ -43,7 +43,7 @@ jobs:
       - name: Temporarily disable branch protections
         id: disable-branch-protection
         if: always()
-        uses: actions/github-script@v6
+        uses: actions/github-script@${{ vars.ACTIONS_GITHUB_SCRIPT_SHA }}
         with:
           github-token: ${{ secrets.OPENSOURCE_BOT_TOKEN }}
           script: |
@@ -65,7 +65,7 @@ jobs:
       - name: Re-enable branch protections
         id: enable-branch-protection
         if: always()
-        uses: actions/github-script@v6
+        uses: actions/github-script@${{ vars.ACTIONS_GITHUB_SCRIPT_SHA }}
         with:
           github-token: ${{ secrets.OPENSOURCE_BOT_TOKEN }}
           script: |
@@ -110,12 +110,12 @@ jobs:
       # Checkout fetch-depth: 2 because there's a check to see if package.json
       # was updated, and need at least 2 commits for the check to function properly
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         with:
           fetch-depth: 2
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Install OSS CLI
         working-directory: ./utils
diff --git a/.github/workflows/repolinter.yml b/.github/workflows/repolinter.yml
index 36e3331909..877f2cb0a9 100644
--- a/.github/workflows/repolinter.yml
+++ b/.github/workflows/repolinter.yml
@@ -15,17 +15,17 @@ jobs:
     steps:
       - name: Test Default Branch
         id: default-branch
-        uses: actions/github-script@v6
+        uses: actions/github-script@${{ vars.ACTIONS_GITHUB_SCRIPT_SHA }}
         with:
           script: |
             const data = await github.rest.repos.get(context.repo)
             return data.data && data.data.default_branch === context.ref.split('/').slice(-1)[0]
       - name: Checkout Self
         if: ${{ steps.default-branch.outputs.result == 'true' }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
       - name: Run Repolinter
         if: ${{ steps.default-branch.outputs.result == 'true' }}
-        uses: newrelic/repolinter-action@v1
+        uses: newrelic/repolinter-action@${{ vars.ACTIONS_REPO_LINTER_ACTION_SHA }}
         with:
           config_url: https://raw.githubusercontent.com/newrelic/.github/main/repolinter-rulesets/community-project.yml
           output_type: issue
diff --git a/.github/workflows/reusable.quickstart_submission.yml b/.github/workflows/reusable.quickstart_submission.yml
index 8fa871bdb8..af4c73b204 100644
--- a/.github/workflows/reusable.quickstart_submission.yml
+++ b/.github/workflows/reusable.quickstart_submission.yml
@@ -31,14 +31,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         # Ensure we have the most recent commit to `main`
         with:
           ref: "main"
           fetch-depth: 0
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Update install plans
         env:
@@ -55,14 +55,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         # Ensure we have the most recent commit to `main`
         with:
           ref: "main"
           fetch-depth: 0
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Update data sources
         env:
@@ -80,14 +80,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         # Ensure we have the most recent commit to `main`
         with:
           ref: "main"
           fetch-depth: 0
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Update quickstarts
         env:
@@ -105,14 +105,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         # Ensure we have the most recent commit to `main`
         with:
           ref: "main"
           fetch-depth: 0
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Update dashboards with required datasources from quickstarts
         env:
@@ -130,14 +130,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         # Ensure we have the most recent commit to `main`
         with:
           ref: "main"
           fetch-depth: 0
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Update dashboards with required datasources from quickstarts
         env:
diff --git a/.github/workflows/run_tests.yml b/.github/workflows/run_tests.yml
index 4b6433cd4e..2045dca1cd 100644
--- a/.github/workflows/run_tests.yml
+++ b/.github/workflows/run_tests.yml
@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Run tests
         run: cd utils && yarn test
diff --git a/.github/workflows/stale-message.yml b/.github/workflows/stale-message.yml
index 6f818a72d8..5b62dd6bc1 100644
--- a/.github/workflows/stale-message.yml
+++ b/.github/workflows/stale-message.yml
@@ -11,7 +11,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v7
+      - uses: actions/stale@${{ vars.ACTIONS_STALE_SHA }}
         with:
           stale-issue-message: "Old issues will be closed after 105 days of inactivity. This issue has been quiet for 90 days and is being marked as stale. Reply here to keep this issue open."
           close-issue-message: "This issue is being closed due to inactivity. Is this a mistake? Please re-open this issue or create a new one."
diff --git a/.github/workflows/submit-gate.yml b/.github/workflows/submit-gate.yml
index d1b5045c54..9609ff659f 100644
--- a/.github/workflows/submit-gate.yml
+++ b/.github/workflows/submit-gate.yml
@@ -4,7 +4,7 @@
 # Having it setup this way allows us to have manual approval for this workflow run, and then the subsequent triggered runs can access secrets in the repository for validation (even for forked PRs).
 name: Submit Gate
 
-on: 
+on:
   pull_request:
     branches:
       - release
@@ -21,6 +21,6 @@ jobs:
         run: echo "${{ github.event.pull_request.number }}" > pr_number_submit.txt
 
       - name: upload artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@${{ vars.ACTIONS_UPLOAD_ARTIFACT_SHA }}
         with:
           path: pr_number_submit.txt
diff --git a/.github/workflows/validate_data_sources.yml b/.github/workflows/validate_data_sources.yml
index ee712f9b63..562194068e 100644
--- a/.github/workflows/validate_data_sources.yml
+++ b/.github/workflows/validate_data_sources.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download artifact
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@${{ vars.DAWIDD6_ACTION_DOWNLOAD_ARTIFACT_SHA }}
         with:
           workflow: validation_gate.yml
           run_id: ${{ github.event.workflow_run.id }}
@@ -24,12 +24,12 @@ jobs:
           echo "pr-number=$PR_NUMBER" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         with:
           ref: "refs/pull/${{ env.pr-number }}/merge"
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Validate new files
         id: validation
@@ -50,7 +50,8 @@ jobs:
 
       - name: Add commit status
         if: always()
-        uses: './.github/actions/add-commit-status'
+        uses: "./.github/actions/add-commit-status"
         with:
           statusContext: "Validation / Data source schema compliance"
-          state: ${{ job.status }}
\ No newline at end of file
+          state: ${{ job.status }}
+
diff --git a/.github/workflows/validate_install_plans.yml b/.github/workflows/validate_install_plans.yml
index 48b09da31c..24797bcee8 100644
--- a/.github/workflows/validate_install_plans.yml
+++ b/.github/workflows/validate_install_plans.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download artifact
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@${{ vars.DAWIDD6_ACTION_DOWNLOAD_ARTIFACT_SHA }}
         with:
           workflow: validation_gate.yml
           run_id: ${{ github.event.workflow_run.id }}
@@ -24,12 +24,12 @@ jobs:
           echo "pr-number=$PR_NUMBER" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         with:
           ref: "refs/pull/${{ env.pr-number }}/merge"
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Validate new files
         id: validation
@@ -49,7 +49,8 @@ jobs:
           cd utils && yarn create-validate-install-plans $URL $DRY_RUN
       - name: Add commit status
         if: always()
-        uses: './.github/actions/add-commit-status'
+        uses: "./.github/actions/add-commit-status"
         with:
           statusContext: "Validation / Install plan schema compliance"
-          state: ${{ job.status }}
\ No newline at end of file
+          state: ${{ job.status }}
+
diff --git a/.github/workflows/validate_packs.yml b/.github/workflows/validate_packs.yml
index 64e5e50a80..acf238cce1 100644
--- a/.github/workflows/validate_packs.yml
+++ b/.github/workflows/validate_packs.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download artifact
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@${{ vars.DAWIDD6_ACTION_DOWNLOAD_ARTIFACT_SHA }}
         with:
           workflow: validation_gate.yml
           run_id: ${{ github.event.workflow_run.id }}
@@ -27,12 +27,12 @@ jobs:
           echo "pr-number=$PR_NUMBER" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         with:
           ref: "refs/pull/${{ env.pr-number }}/merge"
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Check for unique names and ids
         id: validation
@@ -40,7 +40,7 @@ jobs:
 
       - name: Add commit status
         if: always()
-        uses: './.github/actions/add-commit-status'
+        uses: "./.github/actions/add-commit-status"
         with:
           statusContext: "Validation / Quickstart id are unique"
           state: ${{ job.status }}
@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download artifact
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@${{ vars.DAWIDD6_ACTION_DOWNLOAD_ARTIFACT_SHA }}
         with:
           workflow: validation_gate.yml
           run_id: ${{ github.event.workflow_run.id }}
@@ -62,21 +62,20 @@ jobs:
           echo "pr-number=$PR_NUMBER" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         with:
           ref: "refs/pull/${{ env.pr-number }}/merge"
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Validate Images
         id: validation
         run: cd utils && yarn validate-images
 
-
       - name: Add commit status
         if: always()
-        uses: './.github/actions/add-commit-status'
+        uses: "./.github/actions/add-commit-status"
         with:
           statusContext: "Validation / Image count and extension compliance"
           state: ${{ job.status }}
@@ -86,7 +85,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download artifact
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@${{ vars.DAWIDD6_ACTION_DOWNLOAD_ARTIFACT_SHA }}
         with:
           workflow: validation_gate.yml
           run_id: ${{ github.event.workflow_run.id }}
@@ -98,12 +97,12 @@ jobs:
           echo "pr-number=$PR_NUMBER" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         with:
           ref: "refs/pull/${{ env.pr-number }}/merge"
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Validate Icons
         id: validation
@@ -111,7 +110,7 @@ jobs:
 
       - name: Add commit status
         if: always()
-        uses: './.github/actions/add-commit-status'
+        uses: "./.github/actions/add-commit-status"
         with:
           statusContext: "Validation / Ensure icons exist"
           state: ${{ job.status }}
@@ -121,7 +120,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download artifact
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@${{ vars.DAWIDD6_ACTION_DOWNLOAD_ARTIFACT_SHA }}
         with:
           workflow: validation_gate.yml
           run_id: ${{ github.event.workflow_run.id }}
@@ -133,12 +132,12 @@ jobs:
           echo "pr-number=$PR_NUMBER" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         with:
           ref: "refs/pull/${{ env.pr-number }}/merge"
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Validate pr quickstart files
         id: validation
@@ -159,7 +158,7 @@ jobs:
 
       - name: Add commit status
         if: always()
-        uses: './.github/actions/add-commit-status'
+        uses: "./.github/actions/add-commit-status"
         with:
           statusContext: "Validation / Validate Quickstart Schema"
           state: ${{ job.status }}
@@ -169,7 +168,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download artifact
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@${{ vars.DAWIDD6_ACTION_DOWNLOAD_ARTIFACT_SHA }}
         with:
           workflow: validation_gate.yml
           run_id: ${{ github.event.workflow_run.id }}
@@ -181,12 +180,12 @@ jobs:
           echo "pr-number=$PR_NUMBER" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         with:
           ref: "refs/pull/${{ env.pr-number }}/merge"
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Validate new files
         id: validation
@@ -199,7 +198,7 @@ jobs:
 
       - name: Add commit status
         if: always()
-        uses: './.github/actions/add-commit-status'
+        uses: "./.github/actions/add-commit-status"
         with:
           statusContext: "Validation / Install plan ids exist"
           state: ${{ job.status }}
@@ -209,7 +208,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download artifact
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@${{ vars.DAWIDD6_ACTION_DOWNLOAD_ARTIFACT_SHA }}
         with:
           workflow: validation_gate.yml
           run_id: ${{ github.event.workflow_run.id }}
@@ -221,12 +220,12 @@ jobs:
           echo "pr-number=$PR_NUMBER" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         with:
           ref: "refs/pull/${{ env.pr-number }}/merge"
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Validate new files
         id: validation
@@ -241,7 +240,7 @@ jobs:
 
       - name: Add commit status
         if: always()
-        uses: './.github/actions/add-commit-status'
+        uses: "./.github/actions/add-commit-status"
         with:
           statusContext: "Validation / Data source ids exist"
           state: ${{ job.status }}
@@ -251,7 +250,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download artifact
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@${{ vars.DAWIDD6_ACTION_DOWNLOAD_ARTIFACT_SHA }}
         with:
           workflow: validation_gate.yml
           run_id: ${{ github.event.workflow_run.id }}
@@ -263,12 +262,12 @@ jobs:
           echo "pr-number=$PR_NUMBER" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         with:
           ref: "refs/pull/${{ env.pr-number }}/merge"
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Check for unique dashboard names
         id: validation
@@ -276,7 +275,7 @@ jobs:
 
       - name: Add commit status
         if: always()
-        uses: './.github/actions/add-commit-status'
+        uses: "./.github/actions/add-commit-status"
         with:
           statusContext: "Validation / Quickstart dashboard name is unique"
           state: ${{ job.status }}
@@ -285,7 +284,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download artifact
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@${{ vars.DAWIDD6_ACTION_DOWNLOAD_ARTIFACT_SHA }}
         with:
           workflow: validation_gate.yml
           run_id: ${{ github.event.workflow_run.id }}
@@ -297,12 +296,12 @@ jobs:
           echo "pr-number=$PR_NUMBER" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
         with:
           ref: "refs/pull/${{ env.pr-number }}/merge"
 
       - name: Setup workspace
-        uses: './.github/actions/bootstrap'
+        uses: "./.github/actions/bootstrap"
 
       - name: Run dashboard helper
         id: helper
diff --git a/.github/workflows/validation_gate.yml b/.github/workflows/validation_gate.yml
index 503bdd3a5c..cefdbfaa97 100644
--- a/.github/workflows/validation_gate.yml
+++ b/.github/workflows/validation_gate.yml
@@ -4,7 +4,7 @@
 # Having it setup this way allows us to have manual approval for this workflow run, and then the subsequent triggered runs can access secrets in the repository for validation (even for forked PRs).
 name: Validation Gate
 
-on: 
+on:
   pull_request:
 
 jobs:
@@ -18,6 +18,6 @@ jobs:
         run: echo "${{ github.event.pull_request.number }}" > pr_number.txt
 
       - name: upload artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@${{ vars.ACTIONS_UPLOAD_ARTIFACT_SHA }}
         with:
           path: pr_number.txt
diff --git a/.github/workflows/yaml-lint.yml b/.github/workflows/yaml-lint.yml
index ea05e10483..471dc3575c 100644
--- a/.github/workflows/yaml-lint.yml
+++ b/.github/workflows/yaml-lint.yml
@@ -3,8 +3,8 @@ name: Lint Yaml
 on:
   pull_request:
     paths:
-      - '**.yml'
-      - '**.yaml'
+      - "**.yml"
+      - "**.yaml"
 
 jobs:
   lint-yaml-files:
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@${{ vars.ACTIONS_CHECKOUT_SHA }}
 
       - name: Run yamllint
         run: |