I Pinned 31 GitHub Actions to Commit SHAs. One Major Tag Was Two Versions Stale.

How to resolve an action's commit SHA with git ls-remote (no API, no rate limit), the annotated-tag trap, and the six lines every workflow should start with.