Re creating releases in https://github.com/pantsbuild/actions (see here for context), have we been doing so manually in the github UI? Should we continue to release periodically, or should we expect users to depend on specific SHAs in their actions, as is the general recommendation these days?

I feel like it's up to teams to come up with their own security practice - e.g. I usually specify major versions when it's github's actions, and SHA specify for everyone else. In this case, in the repo, we don't really encourage it's use (while not actively discouraging it).

This repository houses actions used by the pantsbuild projects. Other use is not discouraged, but it's also not actively supported at this time.

When adding a new action, just claim a meaningful top-level directory name to house it and then consume it as described here.

No tagging protocol is established yet; so it's probably wise to depend on a specific sha.

In the docs, slightly different: https://www.pantsbuild.org/blog/2023/02/23/the-pants-launcher-binary-a-much-simpler-way-to-install-and-run-pants#embedding-an-interpreter Might be a good time to decide on an actual policy for those actions. Recommended or not.