Developer Pins 31 GitHub Actions to SHAs, Finds Major Tags Hiding Stale Versions

A developer pinned 31 GitHub Actions to specific commit SHAs while packaging workflows, using git ls-remote instead of the rate-limited GitHub REST API to resolve each pin without a token. The process revealed that actions/dependency-review-action's v3 major tag points to an unmaintained release line, two full major versions behind the current v5.0.0. Similarly, sigstore/cosign-installer's v3 tag lags behind its own latest release of v4.1.2, meaning users relying on major tags cannot assume they are on the newest version. A third finding showed that aquasecurity/trivy-action publishes no floating major tag at all, leaving workflows pinned to a branch — considered less secure than even a mutable tag. The exercise highlighted that major version tags in GitHub Actions can silently fall behind, and only inspecting the upstream release list reveals the true state of a dependency.