Mutable tags break linting of GitHub Actions workflows

[iainsproat]

On July 16th 2026 the v1.0.0-beta tag was moved from commit 41cdeedae8edb2e684ba22896a5fd2a3cb85db6b to 01ab2a058dd0d41e292217b76582a6f9867c02ce.

For security reasons we pin the versions of checkout to the commit SHA and note the expected version number in a trailing comment, as follows:

    steps:
      - name: Checkout repository
        uses: useblacksmith/checkout@41cdeedae8edb2e684ba22896a5fd2a3cb85db6b # v1.0.0-beta
        with:
          persist-credentials: false

Tooling, such as Zizmor, are able to lint this to ensure the documented version matches the commit sha. If mutable tags are used, our downstream pipelines break.