In CI/CD workflows, mitigate supply-chain risk by ensuring every `uses:` action (first- and third-party) is pinned to an immutable full commit SHA, not a moving tag/branch. Optionally preserve the intended human version in a trailing comment. Also, set critical inputs explicitly when supported (e.g., toolchain selection) to keep builds deterministic. Example: ```yml steps: - uses: dtolnay/rust-toolchain@ # stable with: toolchain: stable ``` Apply this to all workflow steps that reference actions (`uses:`), including internal or vendored actions.