That still doesn't help when the action is a docker action only marked with a tag. So you need to check the action.yml itself to see if it has a sha256 pinned

That still doesn't help when the action is a docker action only marked with a tag. So you need to check the action.yml itself to see if it has a sha256 pinned (in the case it uses Docker).