Hacker News Reader

Pinning actions doesn't really work because most action dependencies are unpinned thanks to npm default behaviour of not pinning them.

Just don't use actions which pull in arbitrary npm packages without a lockfile.

Why does this matter?

JavaScript actions are already bundled.