Pin actions to a full length commit SHA ?

In its documentation, https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions, GitHub recommends to pin GitHub actions to a full length commit SHA.

The Disadvantage of this is that it's more work compared to pinning actions to a tag. But it can be simplified by letting Dependabot handle the dependency upgrades.

One nice side effect is that there will be more activity to the repository. So this helps preventing scheduled GitHub Actions from becoming disabled when there is no activity for X consecutive days. Note that this is less needed by plugins in adsf-community because it seems there is a bot that generates activity every now and then (see "Update .github/CODEOWNERS" commits in https://github.com/asdf-community/asdf-graalvm/commits/master for exemple).

Should GitHub action pinning to a full length commit SHA be applied to this template repository ?

Inspect the repository's GitHub Actions configuration and the existing Dependabot setup, using GitHub's linked security-hardening guidance as the reference. Determine whether all third-party actions in this template should use full commit SHAs and whether Dependabot can maintain them; done means the repository's intended policy is applied consistently and documented by passing checks.

Written by the indexing model from the issue text.