uses: some/action@v2 resolves a tag, and a tag is a mutable pointer — so the code running in your pipeline can change without anything in your repository changing.
# a moving target
- uses: some/action@v2
# pinned to a commit, which cannot change
- uses: some/action@8f4b7fa8c5f8e07e2b6c50e0e79ee1e4e2d0f3a1
# and the audit
# grep -rn 'uses:' .github/workflows | grep -v '@[0-9a-f]{40}'The threat is a maintainer account compromise rather than a malicious maintainer, and the blast radius is every secret the workflow can read. Pinning to a SHA removes it and costs a dependency-update tool that understands the convention. For first-party actions the risk is negligible and the tag is fine; for anything else in a workflow with deploy credentials, the SHA is the defensible choice and it is worth writing that rule down rather than deciding per action.