Pin the GitHub Action to a commit
uses: actions/checkout@main builds whatever that branch points at today. A SHA names the commit you read. A tag can still move.
A branch name is not a version
The line `- uses: actions/checkout@main` names a branch. `main` moves. So does `master`. The next push to that action changes your workflow, and you will not get a diff in your own pull request when that happens. The action-pinned-to-main check looks for `@main` and `@master`. Its example is `actions/checkout@main`. It does not look up the action repository, and it does not invent a SHA when the workflow only names a branch. It does not flag `@v4`.
A release tag can still be moved by whoever owns the tag. A 40-character commit SHA names one commit. Moving the branch does not change that commit. The check accepts a release tag or a full SHA. I still want the SHA on the `uses` line, because the tag can move. That is the review bar.
Copy the SHA you actually read
Open the commit you read and copy that SHA onto the `uses` line: `actions/checkout@` followed by the 40 hex characters. A comment can keep the tag name. A local action, `uses: ./actions/build`, is your code. This check is about someone else's action.
Paste the workflow and ask for the `uses` line. If it still says `@main` or `@master`, that is the comment. A `pull_request_target` checkout of the pull request head is a different check. Pinning the SHA does not make that checkout safe.