And, the one often forgotten: `runs-on:` also refers to an image, but in practice a huge amount of people will just set it to `ubuntu-latest` and accept whatever GH happens to include that day. In fact, I don't think it is even possible to refer to a specific runner image revision by digest...