Pin every external action and reusable workflow to a full commit SHA
Tag and branch refs are mutable, so a compromised upstream tag changes what runs in your workflow without a diff in your repo.
Observable check
every external uses: line in .github/workflows/, including GitHub-owned actions and reusable workflows outside the current repository, resolves to a 40-character commit SHA.