Why pin to a commit SHA?

A version tag like v4 is a label the maintainer can move. Point a workflow at a tag and you run whatever commit that tag names today — which may not be the commit you reviewed. A moved tag can swap the code under you without a single change to your workflow file.

A full commit SHA names one exact commit and can never point anywhere else. Pinning to it means every run executes the code you actually vetted, so a compromised or careless tag move can't reach your pipeline.

The trailing version comment is load-bearing, not decoration: Dependabot and Renovate read it to know which release a SHA belongs to, so they can still open update pull requests against a SHA pin. actionaut copies the snippet with that comment intact — paste it as-is and it is valid, review-ready workflow YAML.