[silverwind]

Pinning actions doesn't really work because most action dependencies are unpinned thanks to npm default behaviour of not pinning them.

[baobun]

Just don't use actions which pull in arbitrary npm packages without a lockfile.

[NamlchakKhandro]

Why does this matter?

JavaScript actions are already bundled.