@sslavic while the guidance to reference actions by hash has historically been the best practice, most of the GH first-party actions are now being published with the new Immutable Actions feature and can now safely be referenced by their tag.

@bdehamer please reconsider

• it would be consistent, e.g. see hash ref in the same file for another dependency https://github.com/actions/attest-build-provenance/blob/main/action.yml#L65
• our CI checks for hash use to enforce best practice, which makes sense since not all actions are published with the new Immutable Actions [GA] github/roadmap#592 feature; it would be hard to support exceptions in the CI (to allow some references by version tag and require others to be referenced by hash), compared to how low effort it is to use hash ref in https://github.com/actions/attest-build-provenance/blob/main/action.yml#L65 (dependabot can keep it up-to-date)

Fixed via #493