Pinned Actions Check vs. OpenSSF Scorecard
Different shapes of tool for an overlapping question. Scorecard scores 18 dimensions of a repository's supply-chain security -- pinning is one of them -- using the GitHub API and a token, usually wired into CI. This page runs only the pinning question, on one workflow file you paste, free, with no token, no install, and no network call of its own.
What each tool is for
OpenSSF Scorecard is an open-source project (github.com/ossf/scorecard) that
runs 18 named checks against a repository -- among them Branch-Protection, Code-Review,
Dangerous-Workflow, Token-Permissions, Vulnerabilities, and Pinned-Dependencies -- and scores each
0 to 10. Its Pinned-Dependencies check, by Scorecard's own documentation, looks at whether a project's
build and release pipeline is pinned to immutable references across several ecosystems (GitHub Actions,
Dockerfile base images, and downloaded-script installs among them), and returns one aggregate score
rather than a line-by-line list. Running it needs a GitHub token to avoid API rate limits, and it is
typically run through the ossf/scorecard-action in CI or read from Scorecard's own public
dataset of already-scanned open-source repositories.
This checker does one narrower thing: you paste the YAML of a GitHub Actions workflow
file, and it lists every third-party uses: line that is not pinned to a full 40-character
commit SHA -- file, line, the mutable reference it found, and the exact git ls-remote
command to look up the SHA yourself. It runs entirely in your browser, needs no GitHub token and no
install, and makes no network call of its own, so it works the same on a private repository's workflow,
an unpushed fork, or a file from a repo you do not administer.
| Question | Where to answer it |
|---|---|
| How does my whole repository score across 18 supply-chain dimensions, tracked over time? | OpenSSF Scorecard -- that is its entire job, and this tool does not attempt it. |
| Which exact lines in one workflow file are an unpinned third-party action, and what do I run to fix each one? | This checker -- a file:line list with a copy-pasteable remediation command, not a score. |
| I need this to work on a private repository's workflow, or a file I have not pushed anywhere. | This checker -- no token, no repository access, nothing leaves your browser. Scorecard's public dataset and default setup target public repositories. |
| I want pinning checked across Dockerfiles and package-manager installs too, not just GitHub Actions. | OpenSSF Scorecard's Pinned-Dependencies check covers more ecosystems than this tool does; this tool is GitHub Actions uses: lines only. |
| I want this wired into CI to block a merge automatically. | Either: Scorecard's own GitHub Action, or this tool's check.py --fail-on-risk for the pinning question specifically. |
The two are complementary, not competing: a repository can run Scorecard for the ongoing 18-dimension score and still reach for this tool the moment the question is "which line, right now, and what do I paste to fix it" on a file that is not yet in a public, tokened CI run.
Common questions
Should I use this checker or OpenSSF Scorecard?
They are different shapes of tool for an overlapping question. Scorecard is a broader, ongoing measurement: it runs 18 named checks against a repository -- Branch-Protection, Code-Review, Dangerous-Workflow, Token-Permissions, Vulnerabilities, Pinned-Dependencies, and more -- each scored 0 to 10, using the GitHub API and a token, usually wired into CI or read from Scorecard's own public dataset of already-scanned open-source repositories. This tool answers only the one question in its name: are the third-party actions in the workflow YAML you paste pinned to a commit SHA. You paste the file, it runs in your browser, and it needs no token, no install, and no repository access, because it never talks to GitHub at all. If you want an ongoing score across 18 dimensions of a public repository's supply-chain posture, Scorecard is the right tool. If you want a fast, private, no-setup answer to one specific question about one workflow file -- including a private repository's, since nothing here is fetched or uploaded -- this is the narrower tool for that.
Does Scorecard's Pinned-Dependencies check do the same thing as this tool?
Not exactly. Scorecard's own documentation describes Pinned-Dependencies as scoring how much of a project's build and release pipeline is pinned to an immutable reference, and by its own account that check looks across multiple ecosystems -- GitHub Actions, Dockerfile base images, and downloaded-script installs among them -- and returns one 0-to-10 score for the repository as a whole, not a line-by-line list. This tool checks exactly one of those surfaces, GitHub Actions uses: lines, and instead of a score it lists every unpinned reference individually with the file, line, and the exact git ls-remote command to look up the commit SHA yourself. Running both is not redundant: Scorecard's score can move for reasons that have nothing to do with your workflow files, and this tool's line-level list does not tell you how your repository compares to any baseline.
Why would I need a token-free, no-install checker if Scorecard already exists?
Three reasons this tool exists alongside it. First, Scorecard's CLI needs a GitHub token to avoid API rate limits in practice, and its GitHub Action needs to run inside your CI with repository access -- this tool needs neither, so it works on a workflow file from a private repository, a fork you have not pushed anywhere, or a repo you do not administer, with nothing leaving your browser. Second, Scorecard is a Go binary (or a container image) you install and configure; this tool is a page you open. Third, when the answer you actually want is "which lines, and what do I run to fix them," a 0-to-10 score is a worse fit than a list of file:line findings with a copy-pasteable remediation command, which is the only thing this tool produces.
Is this page affiliated with OpenSSF or the Scorecard project?
No. This site is not affiliated with, endorsed by, or sponsored by the Open Source Security Foundation or the Scorecard project. Scorecard is an open-source project of the OpenSSF, named here only to describe what this checker is and is not, using facts drawn from Scorecard's own public documentation and source repository at github.com/ossf/scorecard.