fix: pin 1 actions to commit SHA, extract 1 expressions to env vars

Author: dagecko

.github/workflows/presubmit.yml

@@ -17,11 +17,13 @@ jobs:
         steps:
             - name: Check required secrets
               run: |
-                  if [ -z "${{ secrets.LLM_API_KEY }}" ]; then
+                  if [ -z "${LLM_API_KEY}" ]; then
                     echo "Error: LLM_API_KEY secret is not configured"
                     exit 1
                   fi
-            - uses: presubmit/ai-reviewer@latest
+              env:
+                LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
+            - uses: presubmit/ai-reviewer@5f1290b6142b14b44cd2e8e3ffda84cd0a22e94f # latest
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                   LLM_API_KEY: ${{ secrets.LLM_API_KEY }}