Pinning GitHub Actions to specific commit SHAs is crucial for security and stability, as tags can be moved. This practice ensures that the exact code reviewed is always executed, preventing unexpected changes. When pinning, it's recommended to include the release version as a comment alongside the SHA for human readability.To find the correct SHA for an action without relying on APIs or external blogs, the git ls-remote --tags command can be used. This command, which has no rate limits, retrieves all tags from a repository. The output will show both the tag and the commit it points to, and for annotated tags, the specific commit SHA is identified with a ^{} suffix.During a recent packaging effort, three common issues were identified with existing action usage. One action's major tag was significantly outdated, pointing to a much older version than its latest release. Another action's major tag lagged behind its own recent releases, creating a misleading impression of being up-to-date. Finally, some actions lacked any major tags, forcing users to pin to the master branch, which is less secure than using specific versions.Beyond pinning, implementing security best practices in GitHub Workflows is essential. This includes setting restrictive permissions, configuring concurrency to prevent race conditions, and ensuring sensitive operations like deployments do not run on pull requests. Additionally, avoiding the use of pull_request_target is a critical security measure.A comprehensive set of production-ready GitHub Workflows is available, incorporating these security principles. These workflows cover various CI/CD tasks and are designed for easy adaptation. The process of pinning actions and applying these security rules can be done efficiently using simple commands and configuration. Pinning actions to SHAs is a fundamental step in a broader security posture.