Comment by AdrienPoupa

Don't forget to pin your GitHub Actions to SHAs instead of tags, that may or may not be immutable!