[joeig]

This recommendation is currently broken. Even when you pin the full commit SHA for an action, that action may still pull in transitive dependencies (other actions) that aren't pinned.

[danudey]

TL;DR Github Actions is the NPM of CI systems.