Hacker News Reader

Honestly what I really want is the latter (mutable references), but pointing to aliases that I own and update manually (the former).

So, fork the action repository and pull from upstream at your own pace?

So JFrog

Yeah, that’s essentially what a lockfile would provide. I think GitHub Actions should really have an (official) one.