You can pin to a commit SHA, and that's what the docs recommend as the "safest for stability and security": https://docs.github.com/en/actions/using-workflows/w

You can pin to a commit SHA, and that's what the docs recommend as the "safest for stability and security": https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsuses https://docs.github.com/en/actions/using-workflows/workflow-...