← Actions transitive pin check
Names no specific product or company — this compares the free tool against the generic method
every maintainer already has: clicking through to each pinned reusable workflow or composite action
on GitHub and reading its own uses: lines by eye.
| Question | Checking by hand | This tool |
|---|---|---|
| Reading one pinned reference's own file | Open the commit on GitHub, find action.yml or the workflow file, read its uses: lines | Fetches the same public file from raw.githubusercontent.com and classifies each reference automatically |
| A workflow with a dozen pinned steps | A dozen separate page loads and reads, one at a time | One paste, one pass over every pinned reference in the file |
| Re-checking after a dependency bump | Easy to skip because it is slow, which is exactly when a reference most needs re-checking | Costs nothing extra to run again; the CLI can also run unattended in CI with --fail-on-risk |
| Telling "unpinned underneath" from "couldn't tell" | A failed or slow page load looks the same as one you didn't get to yet | A fetch that fails is reported as unresolved, never folded into a clean result |
| Judgment about whether your CI is safe overall | A careful human reading brings context this tool has none of | Checks one narrow thing and says so — not a security audit |
Neither method tells you whether a mutable tag it finds is itself trustworthy — both only establish whether a reference is pinned to a fixed commit or not.
uses: lines myself?For one reference, yes — open the reusable workflow or composite action at the pinned commit on
GitHub, read its action.yml or workflow file, and see whether its own uses:
lines are pinned to a SHA or a mutable tag. This tool does exactly that fetch and that read, for every
pinned reference in the workflow you paste, in one pass, and reports which ones load something unpinned
underneath — rather than you repeating the click-and-read for each line by hand.
Not correctness — a careful read of one reference by hand is as accurate as the tool's read of that same reference. What it misses is coverage: a workflow with a dozen pinned steps means a dozen separate page loads and reads, and a repository with many workflow files multiplies that by every file, every time a dependency is bumped. The check that gets skipped because it takes ten minutes is the check that misses the one reference that changed.