chore: pin commit sha instead of version tag

Author: michaelwittwer

.github/workflows/main.yml

@@ -70,7 +70,7 @@ jobs:
       # report coverage only for non PR
       - name: coveralls
         if: ${{ startsWith(github.ref, 'refs/pull/') == false }}
-        uses: coverallsapp/github-action@v2
+        uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}