Checklist for fast, secure, maintainable pipelines: pinned actions, least privilege, OIDC, concurrency, timeouts, caching and reuse.
Top-level permissions: contents: read; grant more per job only where needed
Tags can be moved by the action owner; a commit SHA cannot. Dependabot keeps SHA pins updated and leaves the version as a comment.