How to pin GitHub Actions to a commit SHA
Why it matters
A tag like @v4 can be moved by whoever controls the action — which is how the tj-actions/changed-files compromise reached thousands of pipelines. A full commit SHA cannot be moved.
How to fix it
Reference actions by full commit SHA:
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Tools such as pin-github-action or Dependabot can do this and keep it updated.
Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.
Related checks
- How to find and remove secrets committed to a Git repository
- Why .env must be in .gitignore (and how to check it is not already committed)
- A .env file is committed to the repository: what to do
- Automated dependency updates with Dependabot or Renovate
- Least-privilege GITHUB_TOKEN permissions in workflows
- The pull_request_target trap in GitHub Actions