I remember when I was asked to replace a core router with a more powerful model. The uptime of the Cisco router was ten years - and it was ten years after the datacenter went into service.
This recommendation is currently broken. Even when you pin the full commit SHA for an action, that action may still pull in transitive dependencies (other actions) that aren't pinned.