Why GHA need a specific hash id instead of using specific version?

[SamYuan1990]

for example, just checkout code action

    steps:
      - name: "Checkout code"
        uses: actions/checkout@v3.5.2

it's not either npm, or container file.
why should I use a version as hash commit instead of just a version as v2?

[SamYuan1990]

if we just use a hash id, then we can benefits from actions/checkout@v3 for any fix patch right?

[spencerschrock]

It's a convenience trade-off. You don't need to update your workflow to the new version/hash, but you also automatically accept any new versions. For something from GitHub, like actions/checkout, I wouldn't be worried about it from a security perspective, but rather a stability one. The new update could break something your workflow depended on for example.

[spencerschrock]

Tags can be changed, where as SHA hashes can't. With something like actions/checkout, I don't think we need to worry about that happening, but we don't have any special logic for GitHub owned actions.