Some do, some do not. GitHub Actions is a recognised ecosystem in the OSV schema and in Dependabot's supported list, so advisories can exist for actions. But GitHub states that alerts are generated only for actions that use semantic versioning, not SHA versioning, so a pinned action can slip past an alert.
Why actions count as dependencies
A workflow file pulls in code written by someone else and runs it with access to your repository and often your secrets. That is the same trust relationship as a library. A scan that stops at package.json and requirements.txt never looks at it.
The evidence that the ecosystem is recognised is in two places. The OSV schema lists "GitHub Actions" among its ecosystem names, and the Dependabot supported ecosystems table lists GitHub Actions with version updates and security updates both supported.
The pinning wrinkle
Pinning to a full commit SHA is good practice, because a tag can be moved. See SHA pinning versus tags for that trade. But GitHub's alert documentation says that for GitHub Actions, alerts come only for actions using semantic versioning, not SHA versioning.
So pinning improves integrity and can reduce advisory visibility at the same time. If you pin by SHA, keep the human readable version in a comment and use a tool that maps the SHA back to a release, or track advisories by another route.
How to check your own coverage
- List the actions your workflows use. A repository search for
uses:across the.github/workflowsfolder works. - Note how each is referenced: tag, branch or SHA.
- Pick one action with a public advisory and reference a vulnerable version in a test workflow.
- Run your scanner and your platform alerts. Record whether either reports it.
- Repeat with a SHA reference to the same release.
The result tells you whether workflows are inside your coverage or outside it. Write the answer down in your scanner coverage matrix.
What to do with the answer
- If actions are not covered, add a weekly inventory of
uses:references to your review routine. - If they are covered only for tags, pair SHA pinning with a bot that proposes updates.
- Whatever you find, restrict the workflow token permissions, because advisory coverage never replaces least privilege.
Safeguard's policies and gates can run on pull requests, and the free scan at https://gold.safeguard.sh/scan covers dependency manifests.
Try it yourself
Open the pull request gate demo and see where in the flow a check blocks a change.
Click through it at your own pace, or open it full screen.
Quick check
Is GitHub Actions a recognised vulnerability ecosystem?
Yes. It appears in the OSV schema ecosystem list and in the Dependabot supported ecosystems.
Will Dependabot alert on an action pinned to a SHA?
GitHub's documentation says alerts are generated only for actions that use semantic versioning, not SHA versioning.
Sources
Last reviewed: 19 October 2026.
