ActionRank
Check your actions

Ensure SHA Pinned Actions

Actively maintained

zgosalvez/github-actions-ensure-sha-pinned-actions · MIT

A Github Action to ensure that actions are pinned to full length commit SHAs

★ 55 starsLast commit yesterdayLatest v5.0.6
B
70
/ 100
Security 73Maintenance 96Popularity 35Reliability 58

Security signals

OpenSSF Scorecard7.1 / 10
SECURITY.md presentYes
Immutable releasesNot enabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@46cfe808a5f1588656ef299eedd0ce2fd7ec0dcc # v5.0.6

Mutable tags like v5.0.6 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: zgosalvez/github-actions-ensure-sha-pinned-actions@46cfe808a5f1588656ef299eedd0ce2fd7ec0dcc # v5.0.6

Score breakdown

Security (35%)73
Popularity (20%)35
Maintenance (30%)96
Reliability (15%)58