Question

Your security team requires that all third-party actions used in workflows be protected against a maintainer force-pushing a malicious commit onto an existing tag. A developer currently references a community action as `some-org/deploy-action@v3`. Which reference change best satisfies the requirement while still guaranteeing the exact code you reviewed will run?

Accepted Answer

Pin the action to a full-length commit SHA, e.g. `some-org/deploy-action@a1b2c3d4e5f6...`

Answer

Pin the action to the major version tag `some-org/deploy-action@v3` since GitHub treats tags as immutable

Answer

Reference the action by branch, e.g. `some-org/deploy-action@main`, to always get the latest reviewed code

Answer

Add `strict: true` under the `uses:` step so GitHub verifies the tag signature automatically