From a security standpoint, what is the most secure way to reference a third-party action?
Select an answer to reveal the explanation.
Short Explanation and Infographic
A full commit SHA is immutable — no one can move it under you. Tags can be force-pushed; branches change every commit.
Full explanation below image
Full Explanation
Git tags (like @v4) can be force-pushed to point to a different commit, allowing a malicious action author to silently change action behavior. Branch names change with every commit. Pinning to a full 40-character commit SHA ensures you always run exactly the code you reviewed and audited. The SHA cannot be changed without breaking the reference. GitHub's Dependabot can automatically submit PRs to update SHA pins when new versions are released, maintaining both security and up-to-date action versions. '@latest' is not a standard convention and 'latest' tags can also be moved.