Your team needs to add a third-party action from the GitHub Marketplace to a production deployment workflow. Security policy requires you to minimize supply-chain risk when selecting and referencing the action. Among the following candidates, which represents the MOST trustworthy choice to adopt?