PINNED ACTIONS CHECK · RUNS IN YOUR BROWSER

Are your GitHub Actions pinned to a commit SHA?

A third-party action referenced by a tag (@v4) or branch (@main) trusts whatever code that ref points to right now — and its owner can repoint it at different code tomorrow. Paste your workflow YAML below and this page finds every uses: line that isn't pinned to a full 40-character commit SHA, with the exact command to look up the SHA yourself.

Nothing is uploaded. The YAML you paste is read in this browser and never leaves your device, and this tool makes no network calls of its own — not even to look up the SHA for you.

1. Paste one or more workflow files

Copy the contents of each file under .github/workflows/ you want checked. Add more blocks for more files — nothing here reads your repository, so pasting is how it sees anything.

Paste at least one workflow file above and click Check.

Prefer a CLI, or want this in your own CI?

Same logic, zero dependencies, one file:

python3 check.py                  # scan .github/workflows under the current directory
python3 check.py /path/to/repo    # scan a specific checkout
python3 check.py --format json    # machine-readable
python3 check.py --fail-on-risk   # exit 2 if any mutable (unpinned) action is found

Get check.py from the repo — stdlib only, nothing to install, no network calls. Wire --fail-on-risk into your own CI to block a newly-added unpinned action before it merges.

Common questions

Why is pinning a GitHub Action to a tag like @v4 a risk?

A tag or branch name is mutable: the action's owner — or an attacker who compromises their account — can repoint it at a different commit at any time. The next time your workflow runs, it runs whatever code that tag now points to, with whatever permissions and secrets your workflow has. A full 40-character commit SHA cannot be silently repointed, which is why GitHub's own hardening guidance recommends it.

Has this actually happened?

Yes. In March 2025 the widely used tj-actions/changed-files action had its version tags repointed at a malicious commit that dumped CI secrets into logs in any workflow that referenced it by tag. Workflows that had pinned it to a commit SHA were unaffected by the retag.

Does this tool fetch anything from GitHub for me?

No. It makes no network calls at all — nothing here can, because nothing here talks to a server. For every mutable reference it finds, it prints the exact git ls-remote command you can run yourself to look up what that ref currently resolves to. The lookup, and the decision to pin, stay entirely yours.

Does a clean scan mean my repository is secure?

No. This checks one specific, well-documented thing: whether third-party uses: references are pinned to a commit SHA. It is not a security audit, and it makes no claim about your repository's overall security or compliance posture.

What about actions in my own repository?

References starting with ./ (a local composite or JavaScript action in the same repository) and docker:// (a container image reference) are skipped — neither is the third-party supply-chain risk this tool exists to catch.

More: how to pin a GitHub Action to a commit SHA. Already run OpenSSF Scorecard? See how this checker compares for the pinning question specifically.