Recommended Free Tools
A green qualification result is meaningful only if a reviewer can identify both what was tested and which evaluator produced the result. Record the evaluator setup alongside the artifact’s identity, and make the evidence apply to the exact artifact intended for release—not merely to source code that could produce a similar build.
What it means to pin the evaluator
Pinning an evaluator means recording the versions and inputs that materially shaped a qualification result. That goes beyond naming a test suite or workflow. A useful record identifies the workflow revision, test or policy suite, fixtures, runner image, relevant toolchain, configuration, and any actions or dependencies that could affect the outcome.
As an Amazon Associate I earn from qualifying purchases.
For AI-assisted evaluation, include the model or provider snapshot when one is available, the prompt or rubric version, tool permissions, and whether the result is advisory or a required control. If a provider does not expose a stable model identity, state that limitation; do not imply that the evaluation can be reproduced exactly.
Pinning makes the evaluator traceable, but does not establish that it is correct, secure, independent, or adequate. A fixed test suite can still miss a defect, and a fixed action can still contain a bug. Review what the evaluator does, what it can access, and what its result can legitimately establish.
Bind the result to the artifact that will ship
A source commit is not an artifact identity. If a test job builds from a commit separately from the release job, the bytes it evaluates may differ from the artifact eventually published. The qualification record should identify the artifact—preferably by a digest or hash—and the release process should promote that same identified artifact rather than treating a separately rebuilt output as equivalent by name alone.
A practical evidence chain is:
- Record the source revision and build workflow run.
- Identify the resulting artifact and its hash.
- Identify the fixtures or other test inputs that affect the result, including hashes where appropriate.
- Record the evaluator identity: suite or policy version, workflow revision, runner image, relevant toolchain, configuration, and consequential actions or dependencies.
- Attach the qualification result to that artifact identity, including the status of each check.
This record improves traceability; it does not guarantee a reproducible build or prove that the evaluator is independent. Match the evidence depth to the decision: a release, security decision, or externally relied-on certification calls for stronger evidence than a local experiment.
What to pin and why
| Evidence item | What to record | What it helps a reviewer determine |
|---|---|---|
| Artifact | Artifact identity and hash or digest | Whether the evidence describes the exact candidate intended for release |
| Workflow | Workflow revision and run identity | Which automation and run produced the result |
| Tests or policy | Suite or policy version | Which rules or checks were applied |
| Fixtures and inputs | Fixture identity and, where relevant, hash | Which test data or other inputs influenced the outcome |
| Execution environment | Runner image, relevant toolchain, and configuration | Which environment and settings shaped the evaluation |
| Actions and dependencies | Versions or immutable revisions for components that can affect the result | Which code and dependencies the evaluator relied on |
| AI evaluator, if used | Model or provider snapshot when available, prompt or rubric version, tool permissions, and result role | What model-led evaluation occurred and how much authority its result had |
Pin GitHub Actions without mistaking a pin for a security review
GitHub’s secure-use guidance says that pinning an action to a full-length commit SHA is currently the only way to use it as an immutable release. Verify that the SHA comes from the action’s own repository rather than a fork, review the action’s source code, and give the GITHUB_TOKEN only the permissions the workflow needs. A tag is more convenient, but it can move or be deleted if the repository is compromised.
A SHA answers which revision ran; it does not establish that the revision is trustworthy or suitable. Consider the action’s code, origin, permissions, and inputs as part of the evaluator’s risk—not just its version string.
GitHub also warns that privileged pull_request_target and workflow_run workflows can expose secrets, write access, or shared caches when they check out untrusted pull-request code. Avoid combining these triggers with untrusted content unless privileged context is genuinely needed and the workflow is designed to handle that content safely.
Govern evaluator changes as changes to the evidence
Freeze the evaluator’s identity for an individual qualification run. Update it through review rather than allowing tests, fixtures, policies, prompts, tools, or workflows to drift silently.
Rank #4
- Compare the old and new evaluator versions and record why the change was made.
- Rerun cases affected by the change.
- Assess whether earlier qualification results need to be recomputed.
- Treat a changed candidate artifact as a new identity; do not carry evidence over by name alone.
This is traceability, not a permanent freeze. Vulnerable dependencies, outdated tests, and changing threat assumptions can require updates; the evidence trail should make those updates visible.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsReport the result and its limits
A status badge alone can hide missing evidence. The qualification record should distinguish checks that passed, failed, were skipped, or remain unknown. It should also say plainly if the exact published artifact did not receive the evidence, or if an evaluator property—such as a stable model snapshot—could not be pinned.
Best Value
For a reviewer, the essential questions are: What exact artifact was tested? Which workflow and evaluator produced the result? Which fixtures or inputs were used? Which checks passed, failed, were skipped, or remain unknown? Did the exact published artifact receive the evidence? What changed after the evaluator was frozen? If an answer is unknown, identify the gap rather than letting a green status imply more than it shows.
Where provenance fits
SLSA is a specification for describing and incrementally improving software supply-chain security. Its build track covers provenance creation, distribution, and verification. Provenance and attestations can help describe and verify properties of a build, but an attestation is not a substitute for examining what it asserts—and it does not prove that the build or evaluator is safe.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
