Use pinned official Actions without a public Tea mirror

tests/test_publication_security.py

@@ -21,3 +21,16 @@ def test_private_production_configuration_uses_secrets():
     ):
         assert "${{ secrets." + key + " }}" in workflow
         assert "${{ vars." + key + " }}" not in workflow
+
+
+def test_actions_downloads_do_not_depend_on_personal_server():
+    import re
+
+    workflow = Path(".github/workflows/verify.yml").read_text()
+    actions = re.findall(r"uses:\s*(\S+)", workflow)
+    assert len(actions) == 4
+    for action in actions:
+        assert re.fullmatch(
+            r"https://github\.com/actions/(checkout|setup-python)@[0-9a-f]{40}",
+            action,
+        )