GitHub Actions: Building and testing Ruby – hash or tag in in "uses" step?

[dentarg]

What article on docs.github.com is affected?

https://docs.github.com/en/actions/guides/building-and-testing-ruby

What part(s) of the article would you like to see updated?

The article, in its examples, is using both uses: ruby/setup-ruby@ec106b438a1ff6ff109590de34ddc62c540232e0 (full SHA) and uses: ruby/setup-ruby@v1 (tag), which one should it be?

Additional information

I think using the v1 tag in all examples would be the best. This was recently touched on in actions/starter-workflows#758. It was also discussed at length in actions/starter-workflows#448 a while back.

[welcome]

Thanks for opening this issue. A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[dentarg]

There's also discussion about full SHA vs tag in actions/starter-workflows#709

[eregon]

I agree @v1 is what most users should use, and if they really care about security they should probably pin everything down to a sha, but that seems very extreme and inconvenient, so I guess <1% users would do that.

[janiceilene]

Thanks for opening an issue @dentarg! I'll get this triaged for the team to take a look 👀

[lee-dohm]

Hello @dentarg, thanks for reaching out!

It appears that this has been corrected in the intervening time between when you opened this and now. I'm going to go ahed and close this, but feel free to let me know if I missed something!

Thanks again!