Versions don't matter in GitHub actions; it takes "Tags" as the highest priority, which maintainers can update at will. Yes, they have to delete the tag first,

Versions don't matter in GitHub actions; it takes "Tags" as the highest priority, which maintainers can update at will. Yes, they have to delete the tag first, but there's a UI button for that. Yes, anyone who's cloned the repo will receive a warning, but have you ever cloned an external GitHub actions repo? Advice to use external GitHub actions, especially security actions, should pin to a sha instead.