> You trust GitHub to give you the right code for a SHA. The vast majority of us...

		michaelmior 14 hours ago \| parent \| context \| favorite \| on: GitHub Actions has a package manager, and it might... > You trust GitHub to give you the right code for a SHA. The vast majority of users use GitHub-hosted runners. If you don't trust GitHub, you have bigger problems than whether the correct code for an action is downloaded.