Taylor Blau sent a patch pinning the actions in .github/workflows/main.yml to full commit IDs, keeping the version names in comments so later updates are easier to review. His stated reason was that some forks are hosted by organizations that restrict which GitHub Actions may run, including requiring pinning to full commit IDs, and the workflow's version tags and branches prevent it from running under such a policy. The patch is based on a merge of ps/ci-housekeeping-and-modernizations and jk/http-curl-strip-creds.
Junio C Hamano pushed back. He did not see why other organizations' limitations should affect the project's workflow, and asked what would happen if another organization preferred readable, concise tag names and sent a revert. He asked whether it would be too much trouble for organizations with this requirement to maintain such changes in their own forks. He noted that updating a dependency, such as moving from checkout@v6 to checkout@v7, would conflict anyway, and someone would then have to translate the symbolic name to a full object name.
Blau replied that there is a good reason to do this in the project's own tree. The actions are executable dependencies of CI, so if a malicious actor repointed a tag such as checkout@v6 at code that modifies the tree, the project would rely entirely on the permissions of the configured $GITHUB_TOKEN. He acknowledged the maintenance cost, including deliberately picking up bug and security fixes within a major version. He argued that a tag does not remove the decision about which code runs but delegates it to whoever can update the tag.
Ben Knoble agreed that pinning is becoming a de facto security standard and suggested the commit message say so, for example that pinned commit IDs protect CI and its secrets from compromised action suppliers. Hamano said that, together with Knoble's comments, he appreciated the pushback and agreed that a different justification would be a good way to go. A later message from Blau repeats the original commit message, so whether the log message has been revised is not clear from the excerpts.