Because GitHub Actions are fetched from Git, the previous advice was to pin to a full SHA instead of a tag. This is because tags are mutable and susceptible to supply-chain attacks where an attacker points a previously safe tag at malicious code.
Good news, both already support lockfiles! Your periodic updates will also update the lockfile. Remember to use cooldowns.
GitHub also recommends verifying lockfiles in CI to ensure it’s up-to-date and not corrupt.
Note I’m using the lightweight ubuntu-slim runner here. Also, it’s pinning to v0.4.1; we’ll have to update that at some point or figure out a way to automate it. That’s for another time.
