From Dev.to
Pinning GitHub Actions to Commit SHAs
Here is something that takes about five minutes and prevents a real attack vector. Most GitHub Actions workflows use version tags like @v1 or @latest. That works fine until a maintainer account gets c...