Floating tags can move after you adopt them. For supply-chain hygiene, pin garnet-org/action to the commit SHA from the current GitHub Release (same artifact as the Marketplace listing).
Latest release tag: v2 · Published Thu, 12 Mar 2026 21:47:59 GMT
Recommended uses: line
uses: garnet-org/action@9e819143e63d6dda04bca2e90ac85e3cf0e5289d # GitHub Release v2
Full SHA: 9e819143e63d6dda04bca2e90ac85e3cf0e5289d
Machine-readable: /pins.txt (for docs, onboarding, and agents). Cached data revalidates about hourly, or immediately when the Action repo triggers POST /api/revalidate-pins (GitHub Release webhook — see project env docs).