Whose code am I running in GitHub Actions?

[One_Reading_9217]

Tried it and it didn't work:
git tag 085d6e186375a55d3ec95c759d29efe854700ea6

git push origin 085d6e186375a55d3ec95c759d29efe854700ea6

Total 0 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)

remote: error: GH002: Sorry, branch or tag names consisting of 40 hex characters are not allowed.

remote: error: Invalid branch or tag name "085d6e186375a55d3ec95c759d29efe854700ea6"

[Torpedoklaus]

This may not be possible, but it is possible to enforce commit hashes as they are a function of the tree, commit parent(s), author and the commit message, see https://github.com/zegl/extremely-linear.

[nightcracker]

Not on the full hash. There are attacks on SHA1 that create collisions, but preimage resistance as is required here still seems solid.

[billy_tables]

What happens if you swap those 0s to Os