Re: [PATCH] ci: pin actions in the main workflow to full commit IDs

Taylor Blau [off-list ref] writes:

Some forks are hosted by organizations that restrict which GitHub
Actions may run, including requiring actions to be pinned to full
commit IDs. Our main CI workflow refers to actions by version tags or
branches, which prevents it from running under such a policy.

I do not see why the limitations of other organizations should
affect our workflow here.  What if another organization prefers
readable and concise tag names?  Would they send a patch to revert
this change, leading to a "last one wins" situation?

Would it be too much trouble for organizations with this specific
requirement to maintain such changes in their own forks?  When we
need to update a dependency (for example, when 'checkout@v6' is
deprecated and we transition to 'checkout@v7'), it would result in a
conflict anyway.  At that point, someone has to translate the
symbolic name to a full object name.  It seems only fair that the
organizations requiring this level of pinning handle that
translation themselves, and the conflict will tell them exactly
which line has the symbolic name that needs to be translated to a
full object name.