> aside from throwing a bit of shade at them using mutable git tags for Actions instead of actually building a package manager

I mean, you can use SHA instead.

Yet most, if not all, READMEs of official branches recommend using mutable vM tags. Not even branches — tags that they re-create.