> This is why I avoid using non-official actions where possible and always set a version for the action. Those are good practices. I would add that pinning the

> This is why I avoid using non-official actions where possible and always set a version for the action. Those are good practices. I would add that pinning the version (tag) is not enough, as we learnt with the tj-actions/changed-files event. We should pin the commit sha.[0]. Github states this in their official documentation [1] as well: > Pin actions to a full length commit SHA > Pin actions to a tag only if you trust the creator [0] https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised#recovery-steps https://www.stepsecurity.io/blog/harden-runner-detection-tj-... [1] https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions https://docs.github.com/en/actions/security-for-github-actio...