Skip to content
Sarj Repo Standards
sarj/github/actions-sha-pinning

Pin workflow dependencies

Non-local workflow dependencies are pinned to immutable digests.

warning beta

Examples

FlaggedFails
uses: third-party/action@v2
PassesClean
uses: third-party/action@0123456789abcdef0123456789abcdef01234567 # v2

Why it matters

A mutable tag can change trusted workflow code without repository review.

How detection works

A non-local uses reference is not a full 40-character Action SHA or sha256 container digest.

What is inspected

  • tracked workflow action references from the selected Git tree

Limits

  • executing actions
  • automatically updating action references

How to fix it

Replace the mutable reference with a reviewed immutable digest.

  1. Pin an Action to its full commit SHA or a container to its sha256 digest.

Verify

  • Run repo-lint again and confirm the rule passes.