A maintainer force-moves the 'v3' tag of a third-party action to a…

Question

A maintainer force-moves the 'v3' tag of a third-party action to a new commit that adds telemetry. Workflows using '@v3' will:

Accepted Answer

Resolve to the new commit on subsequent runs, picking up the telemetry changes — Floating version tags are mutable references. Moving v3 changes what @v3 fetches on the next workflow run.

Answer

Continue running the previous commit forever because tags are immutable on GitHub

Answer

Fail validation until Marketplace re-approves the tag move

Answer

Automatically open a security PR but never change the resolved action code

A maintainer force-moves the 'v3' tag of a third-party action to a new commit that adds telemetry. Workflows using '@v3' will:

Short Explanation and Infographic

Full Explanation