Docker and CI/CD · Middle · Question 42 of 75

Why pin third-party actions to a full commit SHA rather than `@v3`?

1Tags stop working after a few months on GitHub
✓Correct answer: A tag can be moved to malicious code; a SHA can't
3Actions run faster when referenced by their SHA

Explanation

If an action's repository is compromised, the attacker can retag v3. Pinning to a SHA (with Dependabot updating it) prevents that.

Further reading

Test yourself

Take the Docker and CI/CD · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.