You specifying the top level hash doesn't do anything to pin transitive dependen...

		barrkel 3 days ago \| parent \| context \| favorite \| on: GitHub Actions has a package manager, and it might... You specifying the top level hash doesn't do anything to pin transitive dependencies, and as the article points out, transitive dependencies - especially dependencies common to a lot of actions - would be the juciest target for a supply chain attack.

Ah, I see it now. Thanks!