> aside from throwing a bit of shade at them using mutable git tags for Actions instead of actually building a package manager

I mean, you can use SHA instead.