Step Security has a useful tool that aids in securing GitHub Actions here: https://app.stepsecurity.io/securerepo

Disclaimer: No conflict of interest just a happy user.