KB / Memory / tech-pin-github-actions
Pin GitHub Actions
Pin actions to version or commit SHA; moving major tags can be force-pushed
Actions run with repo secrets. Prefer @vX.Y.Z or commit SHA pins; avoid floating @v0.
Incident reference: trivy-action tags force-pushed (2026). Related: tech-trivy-two-phase, feedback-public-kb-only.