Commit hash pinning in GitHub Actions: secure, but at a cost | Not Hacker News!