1
A GitHub Actions tag is a promise, not a fact: pinning by SHA the right way
别再盲目信任v4标签！用真实踩坑经验讲透GitHub Actions按SHA锁定的正确姿势，供应链安全实操干货
When you write uses: actions/checkout@v4 in a GitHub Actions workflow, you are not pinning anything. You are trusting a promise. A tag is a movable po…