Hey @daantimmer, thank you for your suggestion!
That makes sense, however the documentation is referring to potential risks when using third-party actions, which is not the case in our scenario. Keeping the version as tag, as stated in the documentation, is more convenient and widely used option, so I would not merge this change at the moment.
However, we may reconsider our approach and potentially come back to it sometime later.
Many thanks for your efforts!

But you are a third party for many others. Which means this GitHub policy can't be enforced when there is a dependency on sonarqube.

docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions

I see your point, thanks for clarifying. And to better understand your concern, is it that you would like to enforce this policy, or are you worried that it may be enforced by Github at some point?

I’d like to add my support for @daantimmer’s request, we also want to enforce this policy across our repositories.

Enabling this new setting (see screenshot) in the GitHub Actions settings currently prevents the sonarqube-scan-action from executing.

Workflow fails with the following error:

Configuration:

- name: SonarQube Scan
  uses: SonarSource/sonarqube-scan-action@8c71dc039c2dd71d3821e89a2b58ecc7fee6ced9 # v5.3.0

FYI: This change killed the action for us on GitHub Enterprise Server where the referenced commit doesn't exist yet.