It's crazy to me is that the Github API for this is so nascent for something that has such a large attack surface. E.g., even if you pin your actions directly, there's still no equivalent of an action lockfile* so all the transitives are still unpinned.
*(I think Github said this is on the roadmap a few months ago)
*(I think Github said this is on the roadmap a few months ago)