Update docs

documentation/continuous-integration.md

@@ -7,10 +7,13 @@
 We use a commit hash instead of a version number to specify which release of a GitHub Action we use in our workflows.
 
 Version numbers are based on Git tags, which are mutable.
-This means a maintainer can alter what code a tag like 'v1.0.0' refers to.
-If you use version number 'v1.0.0', you might download altered code without knowing it.
 This is a security risk.
 
+For instance, if Action X is tagged as 'v1.0.0', pointing to commit A, and a malicious actor takes over the Action X repository,
+they can add harmful code in commit B.
+They could then change the 'v1.0.0' tag to point to commit B instead.
+If you use '[email protected]' in your workflow, you would download code from commit A one day and from commit B the next, without realizing it.
+
 Commit hashes refer to specific commits, giving you more confidence about the version of the Action you are downloading.
 While it is not impossible to generate the same hash with different content, it is very difficult.