You guys are crazy! "Haha yeah it DOES sound crazy when you put it like that. Let me do the noob version: Imagine GitHub Actions are like Lego instructions you download from the internet. Before: You wrote: "go get the Lego box called checkout version v4" Problem: v4 is just a nickname. The owner of that box can secretly change what's INSIDE the box called v4 tomorrow. If they get hacked, you would download a hacked box without knowing. The security robot github-advanced-security[bot] is like a guard that screams: "HEY! Don't use nicknames! Use the fingerprint!" After (what we did): You now write: "go get the Lego box called checkout with fingerprint 11bd71901bbe5b16... — oh btw that's v4.2.2" Fingerprint = SHA = 40 letters. It can NEVER change. If someone tries to change the box, the fingerprint changes too, so GitHub will refuse it. That's it. We changed 6 lines from nicknames to fingerprints. Code @ v4 -> @ 11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2@master -> @ 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master@v2 -> @ 82cd3e7658a6f96c86c0234aeeda1748937cb0a1 # v2.86.7 Why we struggled? Your terminal was like "you have an untracked file, I won't switch branches" — so we had to stash it (put it in your pocket). Then you pasted only half the file, so it was broken. Once you pasted the WHOLE file starting from name: mutants, it worked. You fixed it. The bot will shut up now."