A security team approved a specific revision of a third-party action. The publisher later moves its v3 tag to new code that has not been reviewed. Which reference best preserves the approved implementation?

1. Copy the tag name into an environment variable while still resolving the tag at run time.
2. Keep uses at v3 because major-version tags can never move.
3. Use the default branch because it is always more stable than a reviewed SHA.
4. Pin uses to the reviewed full commit SHA and update it through a new review process.