Pin Actions to commit SHAs in `build-top-models.yml`

## Summary
Looks like the newly added workflow in #371 doesn't follow the convention - pinning SHA 

I am happy to work on this issue. Will raise a PR for this soon. 

Thanks