GitHub Action is not pinned to a commit SHA
A workflow references a GitHub Action by a branch or version tag. Tags move; a compromised or hijacked tag runs attacker-controlled code in CI with repository secrets. Pin the full commit SHA.
medium likely application source OWASP A08:2021 / CWE-829
How to fix it
Pin the action to a full commit SHA (keep the tag in a comment for humans).
Check your own repository
npx owlwarden scan --preset deep
npx owlwarden explain ci-unpinned-action
explain prints the rule and fixes in the terminal. It does not
use the network.