Updates

Author: PagelsR

learn-pr/github/github-actions-automate-tasks/includes/2-github-actions-automate-development-tasks.md

@@ -176,6 +176,11 @@ When creating workflows in GitHub Actions, you can reference actions from variou
        uses: actions/checkout@v3
    ```
 
+[!IMPORTANT]
+> **For better security, use a full commit SHA when referencing actions—not just a tag like `@v3`.**  
+> This makes sure your workflow always uses the exact same code, even if the action is updated or changed later.  
+> Example: `uses: actions/checkout@c2c1744e079e0dd11c8e0af4a96064ca4f6a2e9e`
+
 3. **The same repository as your workflow file**  
    You can reference actions stored in the same repository as your workflow file. This is useful for custom actions that are specific to your project. To reference such actions, use a relative path to the action's directory. For example:
    ```yml
@@ -184,6 +189,8 @@ When creating workflows in GitHub Actions, you can reference actions from variou
        uses: ./path-to-action
    ```
 
+For more details, see [security hardening guidance for GitHub Actions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions).
+
 4. **An enterprise marketplace**  
    If your organization uses GitHub Enterprise, you can reference actions from your enterprise's private marketplace. These actions are curated and managed by your organization, ensuring compliance with internal standards. For example:
    ```yml
@@ -196,7 +203,8 @@ When creating workflows in GitHub Actions, you can reference actions from variou
 - Actions in private repositories can also be referenced, but they require proper authentication and permissions.
 - When referencing actions, always specify a version (Git ref, SHA, or tag) to ensure consistency and avoid unexpected changes.
 
-For more information, see [Referencing actions in workflows](https://docs.github.com/actions/using-workflows/referencing-actions-in-workflows?azure-portal=true).
+For more information, see [Referencing actions in workflows](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions).
+
 
 ## GitHub-hosted versus self-hosted runners