A GitHub Actions tag is a promise, not a fact: pinning by SHA the right way

When you write uses: actions/checkout@v4 in a GitHub Actions workflow, you are not pinning anything. You are trusting a promise. A tag is a movable pointer. Whoever owns that repository can repoint v4...