I've found maintaining GitHub Actions workflow files is much easier when it's generated from Typescript.
The latest realization is that the output yaml file can act like a lockfile. So I maintain `actions/checkout@v6`, but the generated output gets locked to a hash.
