Yeah I feel uneasy about using third-party GitHub actions. I suppose you could use `action@<hash>` syntax instead of a tag... At least actions are usually self-

Yeah I feel uneasy about using third-party GitHub actions. I suppose you could use `action@<hash>` syntax instead of a tag... At least actions are usually self-contained, you don't have the same problem of transitive dependencies you have in npm.