Why pin third-party actions to a commit SHA?
⚡
Quick Answer
Tags are mutable; a hijacked tag could run malicious code in your pipeline with access to secrets. A SHA is immutable.
Detailed Answer
uses: some/action@v3 trusts whoever controls that tag. If their account is compromised and they move the tag, your next run executes new code with your secrets. Pinning to a full commit SHA (some/action@<sha>) freezes exactly what runs; use Dependabot to update pins deliberately.
💡
Interview Tip
Mention Dependabot to keep SHA pins fresh.
github-actionssupply-chainpinning