Presumably it’s for the transitive dependencies. You pin action X, but that (third party) action doesn’t correctly pin the SHA of action Y, so you still get owned if the mutable tag gets moved to a compromised commit.
replyBut with a lockfile, direct and indirect dependencies both get pinned. (I presume, and haven’t checked yet, but otherwise this feature would be useless)
Use the gh actions-lock extension for the GitHub CLI to generate .github/workflows/actions.lock for actions and their transitive dependencies.
You can keep the information provided by the version number, and if the maintainer is using real SemVer, it's easier to upgrade.
reply> You can keep the information provided by the version number
replyThe old way of just writing this in a comment on the same line seems fine to me -- intuitive and much more concise.
> if the maintainer is using real SemVer, it's easier to upgrade
Could you elaborate on this? I didn't see how yet.