Ditto, plus it's hard to lock in versions for specific 3rd party actions and keep them updated. You either get 'latest' and hope the 3rd party is trustworthy, o

Ditto, plus it's hard to lock in versions for specific 3rd party actions and keep them updated. You either get 'latest' and hope the 3rd party is trustworthy, or you have to enter in SHAs.