Floating tags can move after you adopt them. For supply-chain hygiene, pin garnet-org/action to the commit SHA from the current GitHub Release (same artifact as the Marketplace listing).
Latest release tag: v2.2.0 · Published Wed, 08 Jul 2026 19:52:41 GMT
Recommended uses: line
uses: garnet-org/action@3d47f4a9004f7356c980a0e8d420ef5984750e3c # GitHub Release v2.2.0
Full SHA: 3d47f4a9004f7356c980a0e8d420ef5984750e3c
Machine-readable: /pins.txt (for docs, onboarding, and agents). Cached data revalidates about hourly, or immediately when the Action repo triggers POST /api/revalidate-pins (GitHub Release webhook — see project env docs).