These SHA's are git commit SHA. Most of them can be validated by looking up the tag using the API.
Here is an example of actions/setup-node@v2
https://api.github.com/repos/actions/setup-node/git/refs/tags/v2
This should provide a result like this.
{