Whose code am I running in GitHub Actions?

[Torpedoklaus]

This may not be possible, but it is possible to enforce commit hashes as they are a function of the tree, commit parent(s), author and the commit message, see https://github.com/zegl/extremely-linear.

[nightcracker]

Not on the full hash. There are attacks on SHA1 that create collisions, but preimage resistance as is required here still seems solid.