Pinned Actions Check vs. reading the workflow YAML by hand
This page names no company or product — reading a workflow file before trusting it is a habit most maintainers already have, not a competing tool. The gap is not carelessness: an abbreviated commit SHA looks pinned at a glance, and telling it apart from a full 40-character one is exactly the kind of check a quick read is bad at.
What a manual read catches reliably
An obvious @v4, @main, or @master on a short, single-job workflow
— a version tag or a branch name reads as clearly not a commit SHA. Those are the cases a reviewer
scanning top to bottom notices without much effort, and this tool does not replace that kind of reading.
What a manual read struggles with, and why
| Case | Reading by hand | This checker |
|---|---|---|
An abbreviated SHA, e.g. @a1b2c3d | Reads as pinned at a glance — it is clearly not a tag or branch name | Classified as mutable: only a full 40-character SHA cannot be silently repointed, and this tool applies that rule the same way every time |
A version tag that looks numeric, e.g. @v4.1.2 | Easy to mistake for "specific enough" since it names an exact release | Classified as mutable — the tag itself can still be repointed by its owner, unlike a commit SHA |
| A repository with a dozen workflow files, several jobs each | Checking every uses: line in every file is repetitive and exactly the kind of check attention degrades across | Scans every pasted file identically; line forty gets the same treatment as line one |
Local actions (./path) and Docker references | Easy to flag as unpinned by mistake, since they carry no SHA at all | Classified separately as local / docker, never counted as a mutable finding |
None of this is about attention or diligence. A 7-character hex string and a 40-character one are both "not a tag", and only the length tells them apart — a distinction that is trivial for a regex and easy to skip while scanning by eye.
When to still read the file yourself
This tool answers one narrow question: is a given uses: reference pinned to a commit SHA.
It does not tell you whether the code at that commit is itself safe, it makes no network call, and it
resolves nothing on your behalf — for every mutable finding it prints the exact
git ls-remote command so you can look up and judge the current commit with your own network
access, which is still a job for you.
Common questions
What does reading a workflow file by hand catch reliably?
An obvious @v4, @main, or @master sitting in a short, single-job workflow -- a version tag or branch name is easy to recognise as not a commit SHA. Those are the cases a reviewer scanning the file top to bottom notices without much effort, and this tool does not replace that kind of reading.
Why is an abbreviated SHA the case a manual read misses?
Because it looks pinned. A reference like some-action@a1b2c3d is not a version tag or branch name, so a quick glance reads it as safe -- but a 7-character abbreviation is not what this tool, or GitHub's own supply-chain hardening guidance, counts as pinned: it can still collide with another commit, and only a full 40-character SHA cannot be silently repointed. Telling a 7-character hex string from a full 40-character one, correctly, on line thirty of a long file, is exactly the kind of check attention is worst at sustaining.
Does file count matter, or is this only about one confusing line?
Both. A repository with a dozen workflow files, each with several uses: lines, turns a pinning review into checking every reference in every file for the difference between a full SHA, an abbreviated one, and a tag that happens to look numeric. A tool that classifies every pasted line the same way does not get less careful on file twelve than it was on file one.
Does a clean scan mean the code at that commit is safe?
No. This tool answers one narrow question -- is this uses: reference pinned to a fixed commit -- and does not evaluate what that commit contains. It makes no network call and resolves nothing on your behalf; for a mutable finding it prints the exact git ls-remote command so you can look up and judge the current commit yourself.