A workflow references 'uses: docker/login-action@v3'. What does the '@v3' portion select?
Select an answer to reveal the explanation.
Short Explanation and Infographic
@ref pins which Git reference of the action repo runs — often a major tag like v3 that maintainers move carefully. It is not the runner version or a Marketplace score.
Full explanation below image
Full Explanation
The uses: owner/name@ref syntax fetches the action from that GitHub repository at the specified ref: commit SHA, tag, or branch. Major version tags like v3 are a common convention where maintainers force-move the tag to the latest v3.x.y release. Branches can move unexpectedly; commit SHAs are the most immutable and are recommended for high-security environments. @v3 does not select a runner version. It is unrelated to Marketplace star ratings. Organizations often enforce policies requiring SHA pins via code scanning or rulesets. Understanding floating tags versus SHAs is a frequent security-adjacent exam theme under actions reuse and supply-chain hygiene.