A third-party action runs with access to your repository contents and whatever secrets the job holds, so it is only as safe as its author and its tags. Pin it to a full length commit SHA, confirm the SHA belongs to the action's own repository, and read what it does.
Why tags are not enough
A version tag such as v3 is a label that the action's owner can move. GitHub's hardening guide notes that a tag can be moved or deleted if a bad actor gains access to the repository storing the action. Every workflow that references the tag then runs the new code the next time it fires.
Why a commit SHA is better
A full commit SHA names one exact snapshot. GitHub's guidance says pinning to a SHA makes it harder for an attacker to slip a backdoor into your workflow, since they would need to produce a SHA-1 collision for a valid Git object. Pinning is the recommended fallback where you cannot use workflow dependency lockfiles.
How to pin
- uses: some-owner/some-action@0123456789abcdef0123456789abcdef01234567 # v3.2.1
Keep the readable version in a comment so humans know what it is. Take the SHA from the action's own releases page.
Check the SHA comes from the right place
GitHub warns that you should verify the SHA is from the action's repository and not from a fork. A fork can carry the same name in the URL path of a commit and contain different code.
Pinned does not mean reviewed
Pinning freezes what you run. It does not tell you the code is good. Read the action's source, especially how it handles your repository content and secrets. Prefer actions with a small, readable codebase, and give the job the least permissions it needs.
Keeping pins fresh
A pin that never moves misses security fixes. Use an update tool that opens pull requests when a new release appears, then review the diff. That gives you control over when new code starts running in your pipeline.
Quick check
Is pinning to a tag good enough?
It is weaker. A tag can be moved or deleted if the action's repository is compromised.
Do I need to pin actions published by my own organisation?
It is less risky, but internal repositories can be compromised too. Pin them if the workflow has access to valuable secrets.
Sources
Last reviewed: 19 October 2026.
