Pin github-based requirements to a specific SHA