Require actions to be pinned to a full-length commit SHA: All actions must be pinned to a full-length commit SHA to be used. This includes actions from your enterprise and actions authored by GitHub. Reusable workflows can still be referenced by tag.
ということが書かれているので、sha pin強制ポリシーはreusable workflowは対象外なのでorgでshaごと指定するとかする必要がある
