From security standpoint, automating GitHub action hash updates defeats the purpose of pinning them in the first place.