? pin-github-actions

Using a branch name or tag name as a version for a GitHub action is dangerous as neither branches nor tags are immutable. (See GitHub’s documentation for more details)

pin-github-actions is a small command-line tool that replaces (“pins”) branches or tag names with their corresponding commit sha.

You can see it in action in this commit:

--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -7,9 +7,9 @@ jobs:
     runs-on: macos-12
-      - uses: actions/[email protected]
-      - uses: gradle/[email protected]
-      - uses: gradle/[email protected]
+      - uses: actions/[email protected] #v3
+      - uses: gradle/[email protected] #v2.2.1
+      - uses: gradle/[email protected]4b #v1
       - run: ./gradlew build


brew install martinbonnin/repo/pin-github-actions


Usage: pin-github-actions [OPTIONS] [PATHS]...

  --update    update to the latest known tag instead of just using the current
  -h, --help  Show this message and exit

  PATHS  The yaml files to process. You can also pass a directory
         in which case it will process all yaml files in that directory.

Frequently Asked Questions

Q: Why pinning the first party actions like actions/[email protected]? GitHub runs the actions, so it should be trusted by construction?

A: It’s true that GitHub has to be trusted to run the actions. Nevertheless, no one is immune to exploits and in the advent that GitHub gets hacked, pinning the GitHub actions reduces a tiny little bit the attack surface. What’s more, it makes the yaml files more consistent.

Q: Can I have a GitHub action that automatically updates the pins?

A: Dependabot and Renovate do this. (albeit with a caveat in the dependabot case)


View Github