Hi,
I noticed that actions-cool/maintain-one-comment@* is in the approved_patterns.yml with a wildcard while the README states:
"Always pin actions to exact commit SHAs, never use tags or branch references."
Could you clarify if:
- For actions with
@* wildcard, we should still use SHA (e.g., @4b2dbf086015f892dcb5e8c1106f5fccd6c1476b)
- Or the wildcard means version tags are acceptable (e.g.,
@v3)
Thanks!