What could be easier, just write a little bit of yaml, careful when you are typing the hash.
```yaml
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
```
This might as well be considered a binary format, in the sense that it has large parts that you don't want human hands touching it.