It's crazy to me is that the Github API for this is so nascent for something that has such a large attack surface. E.g., even if you pin your actions directly, there's still no equivalent of an action lockfile* so all the transitives are still unpinned.

*(I think Github said this is on the roadmap a few months ago)

Disclosure: I work at Semgrep but figure other engineers may find the approach we used interesting.