Yes, for third party actions, pin to a full length commit SHA. GitHub's guidance says a tag can be moved or deleted if the action's repository is compromised, while a SHA names one exact commit. Pinning to a tag is acceptable only if you trust the creator.
What GitHub says
The secure use reference gives four points worth repeating. Pin each action to a full length commit SHA. Confirm the SHA comes from the action's own repository and not from a fork. If your repository can adopt a workflow dependency lockfile, use it, because it records exact commits for all dependencies including transitive ones and supersedes SHA pinning. And audit the action's source for how it handles your repository contents and secrets.
Tag, branch or SHA
| Reference | Can it change under you? | Review effort |
|---|---|---|
| Branch such as main | Yes, on every push | Cannot be reviewed once |
| Tag such as v4 | Yes, if the tag is moved | Low, but trust based |
| Full commit SHA | No | Needs a note on which version it matches |
A short SHA is not a substitute. Use the full length value.
The cost of pinning
A pinned SHA is harder for people to read, and updates become a deliberate step. Two habits keep it workable:
- Add a comment with the human version next to the SHA, so a reviewer sees what it is meant to be.
- Let an update tool propose SHA bumps as pull requests, and review each one like a dependency change.
- uses: example-org/example-action@0123456789abcdef0123456789abcdef01234567 # v4.2.1
The SHA above is a placeholder, not a real action.
Reviewing a SHA bump
When a bot proposes a new SHA, the diff shows two opaque strings. Open the compare view between the old and new commit in the action's repository. Look at what changed in the entry point, any downloaded binaries and any network calls. If the release notes and the code diff disagree, ask before merging.
Check also that the SHA is part of the action's own history. GitHub explicitly warns to verify the SHA is from the action's repository and not a fork, because a fork can hold a commit that looks identical in a workflow file.
What pinning does not do
Pinning stops a moved tag from changing your build silently. It does not make the pinned code safe, and it does not cover what that action downloads at run time. A pinned action can still fetch an unpinned script. Pair pinning with least privilege for the token and with review of the action's source for anything that touches secrets.
Where Safeguard fits
Safeguard's dependency and SBOM scanning is available in the free scan at gold.safeguard.sh/scan, and its policies and gates can enforce rules on pull requests.
Quick check
Is pinning to a tag enough?
Only if you trust the creator. GitHub notes tags can be moved or deleted if a repository is compromised.
Does a SHA guarantee the action is safe?
No. It guarantees the code does not change silently. You still need to audit what that code does.
Sources
Last reviewed: 19 October 2026.
