Or first use it with the tag (just once) and go to the build log. In the section "Setup Job", you will see the SHA sums of the actions it downloaded: