I also find it annoying when Claude Code picks an old action version, but dependabot immediately opens a PR to fix it, so that seems as convenient as remembering to point it at something like this. It was more annoying when it used to do web searches to try to get the hash to pin to (which was always wrong), but these days I think there’s a baked in skill that knows how to use Git to get the right one.