Floating tags can move after you adopt them. For supply-chain hygiene, pin garnet-org/action to the commit SHA from the current GitHub Release (same artifact as the Marketplace listing).
Latest release tag: v2.3.0 · Published Thu, 24 Sep 2026 04:38:57 GMT
Recommended uses: line
uses: garnet-org/action@245ad6be82de3200c205109c8ca7ac816dc692ea # GitHub Release v2.3.0
Full SHA: 245ad6be82de3200c205109c8ca7ac816dc692ea
Machine-readable: /pins.txt (for docs, onboarding, and agents). Cached data revalidates about hourly, or immediately when the Action repo triggers POST /api/revalidate-pins (GitHub Release webhook — see project env docs).