Security requires immutable third-party action references. Which uses: line best meets that requirement?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Pin marketplace/actions to the full commit SHA (optionally comment the version). Floating tags like v4 or main can move.
Full explanation below image
Full Explanation
Tag and branch refs are mutable: a maintainer can force-push or move v4 to different commits. Full 40-character SHAs pin exact code. Many orgs enforce SHA pinning via policy or Dependabot for actions. @main is worst for supply-chain stability. docker://alpine:latest also floats. When pinning SHAs, keep a human-readable version comment and use automated updates. Official actions still benefit from pinning in high-assurance environments. Combine with least-privilege permissions.