A mutable version tag is a promise the maintainer can break.
Third-party CI actions are dependencies too — with exactly the same trust concerns as SCA in Module 2, just easy to overlook as "infrastructure, not code."
mutable tag
# trusts whatever "v4" points to, forever - uses: actions/checkout@v4
pinned commit sha
# guaranteed to run the exact code you reviewed - uses: actions/checkout@8f4b7f84864484a7bde019a09fc0e2d5b7c8f5f2
Real incident: in 2024, tj-actions/changed-files was compromised — a malicious update pushed under an existing tag, causing pipelines pinned to
@vX (not a SHA) to unknowingly leak secrets.✓Least-privilege pipeline credentials
✓Isolated, ephemeral build runners
✓No secrets exposed to untrusted PR code
✓Branch protection, no force-push to main
✓Signed, verified commits
✓Every third-party action pinned to a SHA
A tag can be moved by the maintainer — or an attacker who compromises them. A specific commit hash cannot.