Using an SHA is an anti-pattern for me. Because by using one, you kind of modele...

		csomar 3 days ago \| parent \| context \| favorite \| on: GitHub Actions has a package manager, and it might... Using an SHA is an anti-pattern for me. Because by using one, you kind of modeled "I am getting this fixed/static thing"; when in reality, it is very far from that. I got bitten by it twice that I learned that you either have a lock file or you don't.

Wait, can you explain how you _don't_ get a static thing from a SHA?