From Google Gemini below:

Pinning GitHub Actions workflows to a specific SHA-1 commit hash instead of a mutable tag (like @v3) or a branch (like @main) is considered a security best practice for several critical reasons.

Here is why this approach is the gold standard for supply chain security:

1. Protection Against "Tag Shifting" (Immutability)

In Git, tags are mutable. A maintainer (or a malicious actor who has compromised the maintainer’s account) can move a tag like v3 to point to a different commit at any time.

If you use uses: actions/checkout@v3, you are trusting that @v3 will always point to the code you expect. If that tag is moved to a version containing a bug or malicious code, your workflow will automatically pull the "poisoned" version the next time it runs. A commit hash, however, is an immutable identifier; it can never be changed to point to different code.

2. Prevention of Supply Chain Attacks

GitHub Actions often run with high privileges, such as access to your GITHUB_TOKEN, secret API keys, or production environments. If a popular third-party action is compromised, an attacker could update the version tag to include code that exfiltrates your secrets.

By pinning to a hash, you ensure that even if the developer's account is hacked and they release a new "v3," your CI/CD pipeline remains locked to the specific, audited version of the code you originally integrated.

3. Predictability and Determinism

Software development relies on reproducibility. If a build passes today but fails tomorrow without any changes to your code, it is usually because an external dependency changed.

• With Tags: An action developer might release a "minor" update that accidentally introduces a breaking change.
• With Hashes: Your workflow environment remains identical across every run. This makes debugging much easier because you can rule out external action updates as the cause of a failure.

4. Meeting Compliance Standards

Security frameworks like SLSA (Supply-chain Levels for Software Artifacts) and the OpenSSF Scorecard require or strongly recommend pinning dependencies by hash. For organizations seeking high security certifications, hash-pinning is often a mandatory requirement.

The Downside: Maintenance Overhead

The primary drawback of pinning to a hash is that you no longer receive automatic security patches or bug fixes from the action maintainer.

The Recommended Compromise:
To balance security with maintainability, developers often use the following format:

- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2

• The Hash: Provides the actual security lock.
• The Comment: Tells human developers which version the hash corresponds to.

To manage the manual updates required by this method, tools like Dependabot can be configured to automatically open Pull Requests that update these hashes when new versions of the actions are released.