Commit hash pinning in GitHub Actions: secure, but at a cost

Should you pin GitHub Actions by commit SHA? Weigh the security benefits against actual toil, Dependabot limits, and pragmatic alternatives for enterprises.