{
  "id": 17994558,
  "title": "GitHub Actually Fixed SHA Pinning. I Wasn't Expecting That.",
  "url": "https://urgent.news/2026/11/03/github-actually-fixed-sha-pinning-i-wasnt-expecting-that",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-03T17:28:28.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/avaines/github-actually-fixed-sha-pinning-i-wasnt-expecting-that-394a"
  },
  "original_language": "en",
  "account": "In March, writer Vaines published an article titled \"The Comforting Lie of SHA Pinning\" after investigating the supply-chain compromise of Trivy on GitHub Actions. They discovered that pinning a GitHub Action to a full commit SHA did not ensure that the executing code came from the intended repository. A malicious fork could be created, and GitHub would resolve and execute the malicious commit, even with organization allowlists and mandatory SHA pinning.\n\nIn October 2026, GitHub announced the general availability of workflow dependency lockfiles, which addressed Vaines' concern. The lockfile records the resolved commit alongside the repository identity, ensuring the code's provenance is validated. With this feature, GitHub can now check that a commit is reachable through the expected repository and reference, rather than merely accepting a Git object in its fork network.\n\nGitHub's new .github/workflows/actions.lock file records the dependency alongside its repository identity. Workflows can reference the dependency using a readable format, while the lockfile records the actual dependency and its metadata, such as the repository ID and SHA. This prevents the execution of malicious code, even if an attacker replaces the legitimate reference with a malicious commit in a forked repository.\n\nThe new feature handles transitive Action dependencies, integrates with Dependabot, and supports policies requiring lockfiles. However, it does not make malicious dependencies trustworthy, and legitimate upstream releases can still be compromised. Additionally, external reusable workflows are not covered by the caller's lockfile.\n\nDespite these limitations, the specific forked-commit substitution issue demonstrated in March is now prevented by workflow dependency locking. Vaines plans to discuss this improvement at Yorkshire DevOps on November 5th, emphasizing that the issue he has been raising has been addressed.",
  "summary": "Originally published at https://www.vaines.org/posts/2026-11-03-github-actually-fixed-sha-pinning/ Back in March, I wrote The Comforting Lie of SHA Pinning , after spending rather too much of my Monday investigating the supply-chain compromise with Trivy and discovering something worrying about how GitHub Actions resolves dependencies. Ultimately, the problem was that pinning an Action to a full…",
  "key_points": [
    "GitHub fixed SHA pinning issue in March 2026",
    "Workflow dependency lockfiles record resolved commit and repository identity",
    "Prevents execution of malicious code from forked repositories"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}