pin GHA versions. readme and workflow tweaks (#15)

.github/workflows/reusable-docker-build.yaml

@@ -109,28 +109,28 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.3.0
       -
         # we need qemu and buildx so we can build multiple platforms later
         name: Set up QEMU
         id: qemu
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v2.1.0
       -
         # BuildKit (used with `docker buildx`) is the best way to build images
         name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v2.4.1
       -
         name: Login to DockerHub
         if: inputs.dockerhub-enable
-        uses: docker/login-action@v2
+        uses: docker/login-action@v2.1.0
         with:
           username: ${{ secrets.dockerhub-username }}
           password: ${{ secrets.dockerhub-token }}
       -
         name: Login to GHCR
         if: inputs.ghcr-enable
-        uses: docker/login-action@v2
+        uses: docker/login-action@v2.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -138,7 +138,7 @@ jobs:
       -
         name: Docker meta
         id: docker_meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v4.3.0
         with:
           # list of Docker images to use as base name for tags
           images: ${{ inputs.image-names }}
@@ -149,7 +149,7 @@ jobs:
         # then push to one or more registries (based on image list above in docker_meta)
         name: Docker Build and Push
         id: build_image
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v4.0.0
         with:
           platforms: ${{ inputs.platforms }}
           context: ${{ inputs.context }}
@@ -167,7 +167,7 @@ jobs:
         # If PR, put image tags in the PR comments
         # from https://github.com/marketplace/actions/create-or-update-comment
         name: Find comment for image tags
-        uses: peter-evans/find-comment@v2
+        uses: peter-evans/find-comment@v2.2.1
         if: github.event_name == 'pull_request' && inputs.comment-enable
         id: fc
         with:
@@ -177,7 +177,7 @@ jobs:
       
         # If PR, put image tags in the PR comments
       - name: Create or update comment for image tags
-        uses: peter-evans/create-or-update-comment@v2
+        uses: peter-evans/create-or-update-comment@v2.1.1
         if: github.event_name == 'pull_request' && inputs.comment-enable
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}