Floating tags can move to broken or malicious commits, as happened with
EndBug/add-and-commit v11 (see apify/crawlee#4051). Pin all third-party
actions to full commit SHAs with the resolved version tag in a trailing
comment. Own-org (apify/*) references stay on floating refs.