This. Using tags is acceptable only for official GitHub actions, anything else should be pinned.