Ensure source version is always consistent with actions/checkout

[robin-aws]

GitHub action I'm referring to: https://github.com/actions/checkout

Follow-up to #36. Ideally, this action should ensure that it always grabs the same commit as the standard action to checkout locally does. I worry there may be other special cases lurking. Perhaps we could even reuse code from that action?