Commit hashes for plugins

[commjoen]

So, as described at https://xpirit.com/github-actions-running-them-securely/ it is best ot either fork an action (too much work) or use commit hashes for them.
Now the question becomes: at what level do we want to trust which action provider?
do we trust:

• github
• docker
• ...that cool dude creating retry mechanisms?

The problem we have with the current tagging scheme is that tags are moved to new commits all the time. The problem we have with this is that we are now frozen on a given version,until we check for better versions.
What would you like to see?