[loginatnine]

This is good, just bear in mind that if you put the hash of an external composite action and that action pulls on another one without a hash, you're still vulnerable on that transitive dependency.

[ebfe1]

oh damn - that is a great point! thanks matey!