Indeed, all the actions tell you to use them via tags. And then GitHub comes and recommends you (in a doc that you're unlikely to find unless you know to look

Indeed, all the actions tell you to use them via tags. And then GitHub comes and recommends you (in a doc that you're unlikely to find unless you know to look for it) to use SHAs to protect yourself from the attack that they themselves enabled. https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions https://docs.github.com/en/actions/security-guides/security-...