Pin third-party actions to a full length commit SHA taken from the action's own repository. A tag can be moved or deleted, so it can change under you. A tag is acceptable only for an action whose author you already trust, and even then a SHA is safer.
Why this is a supply chain question
Your CI workflow runs other people's code with access to your repository and secrets. That makes an action a dependency, and an unpinned action is a dependency you cannot reproduce. This is a build system exposure: if the action changes, your pipeline changes, with no commit in your repository.
GitHub's hardening guide says to pin references to actions to a commit SHA, which guards against a bad actor adding a backdoor to the action's repository. It also warns to verify the SHA comes from the action's repository and not from a fork, and notes that pinning to a tag is only reasonable if you trust the creator.
Options compared
| Reference style | Can it change silently? | Readable | Maintenance |
|---|---|---|---|
| Branch name | Yes, constantly | Yes | None, which is the problem |
| Tag | Yes, tags can be moved or deleted | Yes | Low |
| Full commit SHA | No | No, needs a comment | Needs update process |
Steps to adopt SHA pinning
- Inventory your workflows. List every uses line across repositories.
- Resolve each to a SHA. Take it from the action's own repository and confirm it is not a fork.
- Add a comment with the tag. Write the human version beside the hash so reviewers know what it means.
- Update on a schedule. Use a dependency update tool that understands action references, and review each bump as you would any dependency.
- Lower token permissions. GitHub recommends the minimum permissions for the workflow token, read only by default, raised per job when needed.
- Limit secret exposure. Anyone with write access to a repository can read its secrets, so scope them and prefer short lived credentials.
Trade offs to accept
Pinning slows how quickly you receive upstream fixes, because each update is a pull request. That is the point. If an action releases a security fix, your update process should let you take it fast.
GitHub also notes that a lockfile for workflows would be the strongest protection, superseding SHA pinning for repositories that adopt it. Check the current docs for whether that feature applies to you.
Quick check
Does SHA pinning protect against a compromised action maintainer?
It protects against a tag being moved to bad code after you pinned. It does not help if you pin or update to a malicious commit, so review updates.
Do first party actions need pinning?
It is a risk decision. Many teams pin everything for consistency.
Where Safeguard fits
Safeguard offers policies, gates and guardrails for pull requests and dependency scanning. Pinning remains a workflow edit you make. A free scan can show you what a repository depends on.
Sources
Last reviewed: 19 October 2026.
