According to https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions, it is essential to pin actions to full length commit SHA to know what actions are used in the CI workflows. Tags can be redirected or edited, hence, only trustable (if we don't trust the author) element that we got is the full length commit SHA.

Adding a comment pointing to the version is appreciated, hence, I plan to implement it this way:

- uses: actions-rs/toolchain@8e603f32c5c6eeca5b1b2d9d1e7464d926082f1d # v1.0.0

cf. actions-rs/toolchain@8e603f3