It looks like that only V4 of the upload-pages action is using a pinned sha for the underlying action of upload-artifacts.
https://github.com/actions/upload-pages-artifact/releases

In order for this action to be fully pinned we can either:

• check the changes and understand if this action is v4 compatible
• ask upload-artifacts to publish a v3 version with the pinning

Since i m interested personally in any outcomes, i can also help to make any of the above happen