For any third-party action in a workflow that holds secrets or write access, pin to a full length commit SHA instead of a tag. Tags can be moved. A SHA cannot, so you control when new code enters your pipeline. Pair pinning with a routine for reviewing updates.
What GitHub says
GitHub's hardening guide recommends pinning an action to a full length commit SHA when your repository cannot adopt other protections. It explains that this mitigates the risk of an attacker adding a backdoor to the action's repository, since they would need to produce a SHA-1 collision for a valid Git object. It also tells you to verify that the SHA comes from the action's own repository and not from a fork.
Security automation is a high value target. It often holds a ticketing token, a chat webhook and write access to pull requests. An action that runs in that job can read what the job can read.
Tag versus SHA
| Tag such as v3 | Full commit SHA | |
|---|---|---|
| Who controls what runs | The action's maintainer, at any time | You, until you change it |
| Readable | Yes | No, so add a comment with the version |
| Update effort | Automatic | Needs a review step |
| Risk if upstream is compromised | New code runs on your next job | Unchanged until you update |
- uses: example/some-action@0123456789abcdef0123456789abcdef01234567 # v3.1.0
When to pin and when to relax
- Pin everything in workflows that have secrets, write tokens or release rights.
- Prefer actions from a small number of maintainers you have reviewed.
- For simple steps, replace the action with a few lines of shell, which removes a dependency entirely.
- For read only jobs with no secrets, a tag is a smaller risk, though pinning is still cleaner.
Whether a SHA pin is covered by vulnerability alerts is a separate question, covered in do vulnerability alerts cover SHA pinned GitHub Actions.
Keep pins from going stale
A pin that never moves misses security fixes. Add a routine:
- Use an update tool that proposes pull requests for pinned SHAs, with the version in the comment.
- Review the diff between old and new commits for anything touching network calls, credential reads or install scripts.
- Group updates monthly, unless an advisory says otherwise. See reducing dependency update noise.
- Record which actions each workflow uses in an inventory so an advisory can be matched fast.
Related controls
Pinning does not limit what a trusted action can do. Combine it with least privilege token permissions and with a separate job for steps that need secrets.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how an inventory lists components and versions, then picture the same list for your workflow actions.
Safeguard builds dependency inventories and SBOMs, so you can see what your software relies on. Try the free scan at gold.safeguard.sh/scan.
Quick check
Is a short SHA fine?
Use the full length SHA. GitHub's guidance specifically names the full length commit SHA.
Does pinning make an action safe?
No. It freezes the code you reviewed. You still need to review it and limit its permissions.
Sources
Last reviewed: 19 October 2026.
