[NewJazz]

Honestly what I really want is the latter (mutable references), but pointing to aliases that I own and update manually (the former).

[ishouldbework]

So, fork the action repository and pull from upstream at your own pace?

[mememememememo]

So JFrog

[woodruffw]

Yeah, that’s essentially what a lockfile would provide. I think GitHub Actions should really have an (official) one.