Pinning GitHub Actions to Commit SHAs

Here is something that takes about five minutes and prevents a real attack vector.

Most GitHub Actions workflows use version tags like @v1 or @latest. That works fine until a maintainer account gets compromised and someone pushes malicious code to that tag. Your CI/CD pipeline pulls it without asking questions.

The fix is embarrassingly simple: pin actions to their full commit SHA instead of a mutable tag.

# Before (risky)
- uses: actions/checkout@v4

# After (pinned)
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

That is it. The action still does the same thing, but now you are pulling an exact snapshot of code that cannot change retroactively. If the upstream repo gets hacked or the tag gets moved, your workflow keeps using the commit you audited.

There are tools like pin-github-action that automate the conversion if you have many workflows. Or you can just copy the SHA from the release page—GitHub shows it next to each tagged release.

The extra verbosity is worth it. You already review dependency updates in your application code. Your CI pipeline deserves the same scrutiny, especially since it has access to your secrets and build artifacts.