fix: pin GitHub Actions to commit SHAs in publication-builder - #3187

By default, WIP only checks the pull request title for the terms "WIP", "Work in progress" and "🚧".

You can configure both the terms and the location that the WIP app will look for by signing up for the pro plan: https://github.com/marketplace/wip. All revenue will be donated to Processing | p5.js – one of the most diverse and impactful Open Source community there is.