Your point about @v6 being movable stuck with me, because it is easy to treat a major tag as if it were fixed. I also liked pairing a full 40-character SHA with a version comment, since that keeps the pin reviewable without losing the human readable release. The read-only default for GITHUB_TOKEN is the part I would adopt first, with write scopes raised only on the job that needs them.
Thank you for such a thoughtful read, and I agree that read-only by default is the best first step. One thing that helps the SHA pinning stay practical: Dependabot or Renovate can bump the pinned SHAs and keep the version comment in sync, so pinning doesn't mean falling behind.
OneLifeVibe
Your point about @v6 being movable stuck with me, because it is easy to treat a major tag as if it were fixed. I also liked pairing a full 40-character SHA with a version comment, since that keeps the pin reviewable without losing the human readable release. The read-only default for GITHUB_TOKEN is the part I would adopt first, with write scopes raised only on the job that needs them.