ACTIONS TRANSITIVE PIN CHECK · RUNS IN YOUR BROWSER

Your workflow is pinned to a SHA. Is what it loads?

Pinning a reusable workflow or composite action to a commit SHA proves that reference cannot be silently repointed. It proves nothing about what the file at that commit itself calls — if it references a third-party action by a mutable tag, your SHA pin never sees it. Paste a workflow below and this checks the one hop underneath every pinned reference.

For the transitive step, this page fetches the exact public file each pinned reference points to, straight from raw.githubusercontent.com — no server of ours sees the request. See "Privacy" below before using it on a workflow you'd rather not do that for.

1. Paste a workflow file

Copy the contents of a file from .github/workflows/.

Paste a workflow file above and click Check.

Prefer a CLI, or want this in your own CI?

Same logic, zero dependencies:

node check.mjs                    # scan .github/workflows under the current directory
node check.mjs /path/to/repo      # scan a specific checkout
node check.mjs --format json      # machine-readable
node check.mjs --fail-on-risk     # exit 2 if a pinned reference loads an unpinned one
node check.mjs --no-network       # top-level classification only, no fetch (offline)

Get check.mjs, analyze.mjs, and classify.mjs from the repo — stdlib only (Node's built-in fetch), nothing to install.

Common questions

If my uses: line is pinned to a commit SHA, isn't that already safe?

It proves that exact reference cannot be silently repointed. It does not prove anything about what the reusable workflow or composite action at that commit itself does. If that file has its own uses: line pointing at a third-party action by a mutable tag, your workflow still runs whatever code that tag currently resolves to — your SHA pin never sees it, because it only pins the one hop you wrote.

Is this a real, current gap, or a theoretical one?

Current as of 2026. GitHub's own Actions security roadmap names this exact gap and describes a planned workflow lockfile that would pin every direct and transitive action dependency by commit SHA, the way a go.sum pins a Go module graph — which means it is not solved by SHA pinning alone today. Existing pinning checkers, including this portfolio's own pinned-actions-check, are explicit that they check only the uses: lines in the workflow file you scan, not what a pinned reusable workflow or composite action loads underneath it.

Does this tool fetch things from GitHub on my behalf?

Yes, for the transitive check only, and only the exact files your pasted workflow's pinned references point to. The CLI fetches over plain HTTPS from raw.githubusercontent.com, unauthenticated, no token, no login. The browser page does the same fetch directly from your browser to raw.githubusercontent.com — nothing passes through any server of ours. If a fetch fails or the file cannot be found, that reference is reported as unresolved, never as clean.

What if the nested reference is a JavaScript or Docker action, not a composite action?

Those have no action.yml with further uses: lines to check, so there is nothing underneath them for this tool to find either way. A fetch that comes back empty for that reason is reported as unresolved, the same as a genuine fetch failure — this tool cannot tell the two apart from outside, so it never claims one when it might be the other.

Does a clean result mean my CI is safe from supply-chain attacks?

No. This checks one specific, narrow thing: whether a reference you have already pinned to a commit SHA loads something else by a mutable tag one hop underneath it. It is not a security audit and makes no claim about your repository's overall security posture.