How would you automate/enforce this?

[Vadorequest]

Thanks for your work for helping devs applying best practices, that should be GitHub's job.

How would you recommend to best enforce this behavior? Through a pre-commit hook?
Doing it manually is too error-prone to my taste.

[mheap]

You could use an action to ensure all workflows in a repo are pinned to a SHA. See https://michaelheap.com/ensure-github-actions-pinned-sha for more info