https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
"We strongly recommend that you include the version of the action you are using by specifying a Git ref, SHA, or Docker tag. If you don't specify a version, it could break your workflows or cause unexpected behavior when the action owner publishes an update. Using the commit SHA of a released action version is the safest for stability and security. If the action publishes major version tags, you should expect to receive critical fixes and security patches while still retaining compatibility. Note that this behavior is at the discretion of the action's author. Using the default branch of an action may be convenient, but if someone releases a new major version with a breaking change, your workflow could break."