A workflow pinned by SHA rather than by tag

A third-party action referenced by tag, and a tag being a movable pointer in somebody else’s repository.

# before
- uses: some-org/some-action@v3

# after
- uses: some-org/some-action@8c1f4a7e9b2d0e6a3f5c7b9d1e3a5c7b9d1e3a5c # v3.4.1

# and the bot that bumps them, with the tag in the
# comment so a human can read what moved.

A tag can be repointed at any commit by anybody with write access to that repository, which makes @v3 a promise about intent rather than about content. Pinning by SHA is the standard advice and it is only useful with the tag in a comment — a diff of two forty-character hashes tells a reviewer nothing about whether this is a patch or a rewrite.