Your point about @v6 being movable stuck with me, because it is easy to treat a major tag as if it were fixed. I also liked pairing a full 40-character SHA with a version comment, since that keeps the pin reviewable without losing the human readable release. The read-only default for GITHUB_TOKEN is the part I would adopt first, with write scopes raised only on the job that needs them.