Which two practices most improve security when consuming third-party Actions? (Choose two.)
Select all correct answers, then click Submit.
Short Explanation and Infographic
SHA pinning with reviewed updates plus least-privilege tokens/secrets materially reduce supply-chain and token-abuse risk.
Full explanation below image
Full Explanation
Third-party actions execute code with your token and environment. Pinning SHAs prevents silent tag moves; Dependabot makes intentional upgrades. Least-privilege permissions and not exposing secrets to untrusted steps limit blast radius. write-all increases damage potential. Floating @main/@latest maximizes unreviewed code drift. Additional controls: allow-lists for actions at org level, OIDC instead of long-lived cloud keys, and CODEOWNERS on workflow files.