Yes. A third-party action or CI plugin runs inside your pipeline, often next to credentials and signing steps, so it is a dependency in every sense that matters. Put it through intake, pin it to a full commit SHA, and keep an approved list the same way you do for packages.
Why pipelines get skipped
Teams often build careful intake for application packages and then let workflow files reference any action by a floating tag. A tag can be moved to point at different code. The workflow file looks unchanged, but what runs is not.
What GitHub recommends
GitHub's security hardening guide for Actions advises pinning an action to a full-length commit SHA. Its stated reasoning is that a bad actor who adds a backdoor to the action's repository would need to generate a SHA-1 collision for a valid Git object payload to alter a pinned reference. It also advises verifying that the SHA comes from the action's own repository and not a fork. For tags, it says to pin to a tag only if you trust the creator.
Intake questions for an action
- Who publishes it, and can you confirm the publisher is who they appear to be?
- What does it need? Look at requested permissions and any secrets it reads.
- Is it a thin wrapper around a script you could write yourself?
- Does it download and run code at runtime from another place?
- How often is it maintained, and what happens if it is abandoned?
If the answer to the fourth question is yes, the action you reviewed is not the code that runs. Review the downloaded component too, or decline.
A simple policy
| Rule | Detail |
|---|---|
| Pin to a full commit SHA | No floating tags or branch names for third-party actions |
| Keep an approved list | Name, pinned SHA, owner, review date |
| Prefer first-party actions | Where an equivalent exists in your platform |
| Limit permissions | Give each workflow only the token scopes it needs |
| Update through pull requests | A bot or person proposes a new SHA, and the diff is reviewed |
Updating pinned actions
Pinning without updating leaves you with stale actions. Add a scheduled job that proposes new SHAs, and review the upstream diff between the old and new commit. If the diff is large or touches the entry point, look closely.
Check existing workflows
Search all repositories for workflow files that use tags, branches or no version. A quick list of unpinned references is often the first useful intake metric, and it tends to be longer than people expect.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how a pull request is checked before merge, which is where a changed action reference should be caught.
Where Safeguard fits
Safeguard's gates and policies check changes at pull request time, and asset discovery helps you find the repositories and pipelines you need to cover. Try the free scan on a repository.
Quick check
Is pinning to a version tag enough?
It is better than a branch, but a tag can be moved. A full commit SHA is the stronger reference.
Does pinning make an action safe?
No. It makes the reference stable. You still need to review what the pinned code does.
Sources
Last reviewed: 19 October 2026.
