In my own project we actively cut down on external CI deps (non-official github actions) as much as possible, it seems incredible unsafe When we do use an exte

In my own project we actively cut down on external CI deps (non-official github actions) as much as possible, it seems incredible unsafe When we do use an external dep (like in two places for our massive project) we pin it to a specific GIT sha that we manually curated to not contain anything weird