ci: pin actions versions, fix checkout order

Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>

.github/workflows/ci.yaml

@@ -2,14 +2,14 @@ name: CI
 
 on:
   push:
-    branches:
-      - master
+    branches: [master]
   pull_request:
 
 jobs:
   build:
     name: Build
     runs-on: ${{ matrix.os }}
+
     strategy:
       # Fail fast is disabled because there are Go version specific features and tests
       # that should be able to fail independently.
@@ -19,14 +19,14 @@ jobs:
         go-version: ['1.16', '1.17', '1.18', '1.19', '1.20']
 
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           go-version: ${{ matrix.go }}
 
-      - name: Checkout code
-        uses: actions/checkout@v3
-
       - name: Build
         run: go build -v ./...