The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Pin each GitHub Action to the full commit SHA of the exact revision you have reviewed: OWNER/REPOSITORY@FULL_COMMIT_SHA. GitHub identifies a full-length commit SHA as the only currently supported way to reference an action as an immutable release. A pin stabilizes which code the workflow calls; it does not certify that code as safe or automatically deliver future fixes.
Pin an action to a full commit SHA
In a workflow file, replace the action’s tag or branch reference with its complete commit SHA:
As an Amazon Associate I earn from qualifying purchases.
steps:
- uses: actions/checkout@FULL_COMMIT_SHAFULL_COMMIT_SHA is explanatory text, not a value to copy into a working workflow. Substitute the full SHA for the exact revision you intend to use. GitHub’s guidance calls this a full-length commit SHA; an abbreviated SHA does not meet that recommendation. Verify that the commit belongs to the action’s source repository, not a fork, and inspect the code and behavior before adopting it. See GitHub’s secure use reference.
Why prefer a SHA over a tag or branch?
A tag is readable and convenient, but its owner can move or delete it. A branch reference follows whatever version is currently on that branch, so its code can change without an edit to your workflow. A full SHA identifies the selected commit, giving a more stable reference.
#1 Best Overall
| Reference | What it selects | Trade-off |
|---|---|---|
| Full commit SHA | A specific commit; GitHub documents this as the immutable action reference. | Later fixes are not adopted automatically, so pins need a deliberate update process. |
| Release tag | A human-readable release label. | The tag can be moved or deleted, changing what the workflow retrieves. |
| Branch | The version currently on that branch. | Branch updates can change workflow behavior without changing the workflow file. |
GitHub explains that a full-SHA pin mitigates the risk of an attacker adding a backdoor by requiring a SHA-1 collision for a valid Git object payload. That is a protection against a particular tampering scenario, not a guarantee against every supply-chain risk. GitHub advises using a tag only when you trust the action’s creator; for third-party actions where reproducibility and supply-chain control matter, prefer a full SHA and review updates before adopting them. See GitHub’s guidance on choosing and customizing workflow actions.
Pin reusable workflows separately
A reusable workflow is called at the job level, rather than as a step. For an external workflow, the reference has this form:
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
jobs:
call-reusable-workflow:
uses: OWNER/REPOSITORY/.github/workflows/WORKFLOW.yml@FULL_COMMIT_SHAReplace the example owner, repository, path, and SHA with the actual workflow details. GitHub supports a commit SHA, release tag, or branch for external reusable workflows and identifies the SHA as the safest option for stability and security. The action pinning policy described below does not prevent reusable workflows from being referenced by tag. Read GitHub’s reusable workflow documentation for the calling syntax and reference options.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsReview the action and limit its access
A stable reference tells you which revision runs; it does not tell you whether that revision is trustworthy. Before using an action, inspect the source at the pinned commit and confirm its behavior, including how it handles repository content, secrets, and outbound communication. Consider using OpenSSF Scorecards to help identify workflow risks, but do not treat a scorecard as a replacement for reviewing the exact revision and its permissions.
Actions can interact with workflow jobs and may be able to access configured secrets or use the GITHUB_TOKEN. Give the workflow only the permissions it needs, and avoid exposing credentials to actions that do not require them. GitHub’s secure use guidance discusses these risks and least-privilege practices.
Require full-SHA pins with repository settings
Repository administrators can configure a policy requiring actions to be pinned to full-length commit SHAs. GitHub’s documented policy covers GitHub-authored, organization-authored, and third-party actions. Its scope does not require reusable workflows to use a SHA; those can still be referenced by tag. Check the current repository or organization settings and GitHub’s Actions settings documentation for the exact controls available to your account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep pins current without giving up review
SHA pinning intentionally stops a workflow from silently following later changes. That stability also means bug fixes and security updates require you to change the SHA. Establish a recurring review process: check for updates to the actions you use, verify the proposed commit in the source repository, review the changes and relevant security information, then update and test the workflow.
Do not assume that a SHA-pinned action automatically receives Dependabot alerts. GitHub says Dependabot creates alerts only for vulnerable GitHub Actions that use semantic versioning. Maintain a separate pin-update and vulnerability-monitoring process. See GitHub’s workflow building-block guidance and its documentation on managing custom actions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
