{
  "id": 19677973,
  "title": "Pinning GitHub Actions to Commit SHAs",
  "url": "https://urgent.news/2026/11/12/pinning-github-actions-to-commit-shas",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-12T17:02:59.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/schiff_heimlich/pinning-github-actions-to-commit-shas-17a0"
  },
  "original_language": "en",
  "account": "Pinning GitHub Actions to their commit SHA addresses a significant security concern. By default, many GitHub Actions workflows utilize version tags such as @v1 or @latest. This convenient approach can be problematic when a maintainer's account is compromised, allowing an attacker to introduce malicious code under a trusted tag. As a result, a developer's CI/CD pipeline inadvertently pulls in potentially harmful code without any prior scrutiny.\n\nA straightforward solution to avoid this risk is to pin actions to their exact commit SHA, rather than relying on mutable tags. Instead of using : actions/checkout@v4, for instance, the updated workflow would use : actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11, referring to the specific commit number (4.1.1) of the action.\n\nWhile the action continues to perform the same function, pinning it to the commit SHA ensures that the code remains unchanged and cannot be retroactively altered. If the upstream repository is compromised or the tag is moved, the workflow will still operate with the previously audited commit. Several tools, like pin-github-action, can automate the conversion process for numerous workflows. Alternatively, developers can manually copy the SHA from the release page, which GitHub displays next to each tagged release.\n\nThe added verbosity may seem unnecessary, but it is a small price to pay for enhanced security. Developers are already diligent about reviewing dependency updates in their application code. Their CI pipelines, which have access to sensitive secrets and build artifacts, deserve the same level of scrutiny. By pinning actions to their commit SHA, developers can significantly reduce the risk of introducing malicious code into their systems.",
  "summary": "Here is something that takes about five minutes and prevents a real attack vector. Most GitHub Actions workflows use version tags like @v1 or @latest . That works fine until a maintainer account gets compromised and someone pushes malicious code to that tag. Your CI/CD pipeline pulls it without asking questions. The fix is embarrassingly simple: pin actions to their full commit SHA instead of a…",
  "key_points": [
    "Pinning GitHub Actions to commit SHA enhances security.",
    "Default tags like @v1 or @latest can introduce malicious code.",
    "Pinning to specific commit numbers ensures unchanged, audited code."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}