A platform team consumes a third-party action in a release workflow and currently references it as a tag. A security review notes that the tag could be re-pointed by the maintainer to malicious code without the workflow file changing. Which reference form should the team adopt to guarantee that the exact reviewed code runs on every future workflow execution?
steps:
- uses: some-org/deploy-action@<ref>- APin to the major version tag such as some-org/deploy-action@v3, because GitHub treats a major version tag as immutable once the maintainer has published a release for it.
- BPin to the default branch such as some-org/deploy-action@main, because the branch reference tracks the maintainer's reviewed mainline and rejects any unreviewed force-pushed commits.
- CPin to the full 40-character commit SHA such as some-org/deploy-action@a1b2c3d, because a commit SHA is immutable and always resolves to the exact tree the team reviewed. Correct
- DPin to a patch version tag such as some-org/deploy-action@v3.2.1, because a fully qualified semantic version tag is locked to its release artifact and cannot be moved afterwards.
Why A is wrong: Tempting because major version tags are the common convenience reference, but a tag is a movable pointer the maintainer can re-point at any commit, so it does not guarantee the reviewed code keeps running.
Why B is wrong: Tempting because main feels authoritative, but a branch reference resolves to whatever commit is at the branch tip and updates silently on every push, so it is even less stable than a tag.
Why C is correct: A full commit SHA names one immutable commit that cannot be re-pointed, so the workflow always executes the exact reviewed code regardless of later tag or branch changes by the maintainer.
Why D is wrong: Tempting because a patch tag looks precise, but any tag including a patch tag is still a mutable Git reference the maintainer can delete and recreate against different code, so it is not a guarantee.