GITHUB ACTIONS AND THE PINNING PROBLEM: WHAT 100 SECURITY PROJECTS REVEAL

Summary from the TLDR InfoSec newsletter

GitHub Actions can be silently changed, putting workflows at risk. Pinning your GitHub Actions to specific commit SHAs can help maintain consistency. Many popular security repositories do not pin all their actions, leaving them vulnerable to potential changes.