Actions are not immutable, period: https://github.com/github/roadmap/issues/592 https://github.com/github/roadmap/issues/592. This issue has been open for years

Actions are not immutable, period: https://github.com/github/roadmap/issues/592 https://github.com/github/roadmap/issues/592. This issue has been open for years and continues to be pushed back, so I would not recommend anyone use any github action as a dependency if they want to protect against supply chain attacks (basically, don't use GHA at all, it's a horrible product if you care about cost/performance/security). You also cannot trust a git commit ID as an immutable reference. Even if you have a checksum available, you have to validate it.