CI and other workflows reference actions by mutable major tags such as actions/checkout@v7 and actions/setup-java@v5. A tag move changes trusted build code without a repository commit or review.
Pin every third-party action to a reviewed full commit SHA, retain readable version comments, and configure Dependabot to propose controlled updates. Add a repository check that rejects non-SHA action references.
CI and other workflows reference actions by mutable major tags such as
actions/checkout@v7andactions/setup-java@v5. A tag move changes trusted build code without a repository commit or review.Pin every third-party action to a reviewed full commit SHA, retain readable version comments, and configure Dependabot to propose controlled updates. Add a repository check that rejects non-SHA action references.