Nit picks: this could say "daily".

This hides the key information

1. Run time
2. Timezone

I mean in addition to what you already have.

@septs Does that info matter, though? Your choices of time and timezone were both arbitrary, no?

This issue need a guideline.

You are right, its a bit deeper in there:

Github actions do not support cron aliases: https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows#scheduled-events

So you are right, this has to be 0 0 * * *. We can resolve this issue.

Maybe add a comment to that effect in case anyone tries.

Something to the effect of Github actions does not support cron aliases should be enough

i think, this is unpredictable random event. is this really what we need?

What you have looks good -- we can't use daily as per the documentation you linked. We just need the comment, because people are likely to get confused (as I did) about why we aren't using daily. Someone might try to change it as a "fix", and might end up inadvertently breaking the cron job. We don't want that. We just want to get across the intention of this configuration. If it needs to change later, we can do that later.

Outside of github actions, sometimes you want to override cron jobs, so daily acts like a variable that you can set to a specific time for multiple scripts if necessary. It is also more readable, and unless there is an override it usually means 0 0 * * *. Unfortunately, we can't use that here but that is fine.

We maybe need use GitHub Support.

This should be a hash, not a tag or branch.

tag based is the general practice of github action

That makes no difference to me. If we need enhancements in the future, we can change the hash.

for any github action, use hash based?

That is my preference, yes. I can make exceptions for GitHub-owned actions (github.com/actions/*).

i choose general community practice

unless i have must be a reason to this practice. (e.q: write in https://github.com/tc39/how-we-work)

@septs this isn't a "PR author choose" kind of thing; there's security/reliability concerns.

This issue need a guideline.

@ljharb and @michaelficarra can write to how-we-work ?

i want to see tc39 github actions practice guideline.

The guideline is "whatever the repo maintainer chooses", generally - I'm not sure why this is a sticking point.