I did read the blog post. More than once, in search for info on transitive dependencies. It doesn’t provide it. You’re right that I should’ve clicked through the official blog post, I got link blindness. I did find it strange that transitive dependencies weren’t included, which is why I repeatedly said it seemed it didn’t. Thank you for the correction.

Your snark is unwarranted, though, since the crux of the comment is not using any Action you haven’t built. Lockfiles don’t solve the complexity and trust problem.

Cosign. It’s the entire point of this article and would be obvious if someone read