{
  "id": 7431555,
  "title": "I Pinned 31 GitHub Actions to Commit SHAs. One Major Tag Was Two Versions Stale.",
  "url": "https://urgent.news/2026/09/15/i-pinned-31-github-actions-to-commit-shas-one-major-tag-was-two",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-15T00:39:08.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jjoyneriv/i-pinned-31-github-actions-to-commit-shas-one-major-tag-was-two-versions-stale-b13"
  },
  "original_language": "en",
  "account": "Yesterday, the author pinned 31 GitHub Actions to their respective commit SHAs. This process revealed three important findings. First, a major tag that is two versions behind its latest release. The action actions/dependency-review-action@v3 points to a commit without a v3.x.y release tag, indicating that the newest release is v5.0.0. The pin should be set to v5.0.0 instead. Second, a major tag that lags behind its own releases. The action sigstore/cosign-installer@v3 points to v3.9.1, while the latest release is v4.1.2. Users should be aware that a major tag does not guarantee access to the latest major version. Third, certain projects lack major tags altogether. In the case of aquasecurity/trivy-action, the workflow uses @master, which is pinned to a branch. This is less desirable than pinning to a tag. The author provides a script that can quickly resolve commit SHAs for various actions, making the pinning process faster and easier. The author emphasizes that pinning is just one component of a strong security posture, and they also recommend implementing least-privilege permissions and following additional best practices. The author has compiled all of this information into a product called the GitHub Actions Production Workflow Vault, which costs $19.99 and includes detailed documentation and verification methods.",
  "summary": "Yesterday I pinned 31 GitHub Actions to commit SHAs for a set of workflows I was packaging. Every SHA was resolved from the upstream repository rather than copied from a README or a tutorial, and the process turned up three things worth writing down — including one action whose v3 major tag is two full major versions behind its newest release. Here is how to pin correctly, without the API and…",
  "key_points": [
    "31 GitHub Actions pinned to commit SHAs",
    "Major tag two versions behind latest release",
    "Script provided for quick resolution of commit SHAs"
  ],
  "editors_take": "The author's experience pinning GitHub Actions to specific commit SHAs highlights the importance of verifying major tags and releases to ensure access to the latest versions and optimal security.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}