Supply Chain
Hash Pinning
Also: integrity pinning, digest pinning
Locking a dependency, plugin or container image to a cryptographic hash so only the exact reviewed content is accepted.
In more detail
A version number can be reassigned or a tag moved, but a hash of the content cannot be faked. Pinning GitHub Actions to a commit SHA and images to a digest means a later change by the maintainer, or an attacker, is rejected instead of silently installed.