I remember reading (but haven’t verified) that even using a specific SHA instead of a tag isn’t a guarantee with GitHub Actions, because the Action itself may have a dependency which does not pin to a SHA, thus making you vulnerable all the same. This lock file strategy does not appear to guard agains that, it seems to be what we had before but trades a bit more readability in one file for an extra (more complex) lock file. Not a trade-off I want to make (but you do you).

Personally I found the risk of running someone else’s GitHub Action in my repo to not be worth it. Even GitHub’s own Action to checkout repos is way more complex than I need it to be and last I checked had dependencies which could be targeted. I opt instead to not run any third-party Actions (not even GitHub’s official ones) in my repos.