# Why tags are a supply-chain risk
A tag is a moving pointer. If it gets reassigned, by compromise, mistake, or a maintainer going rogue, every workflow referencing it silently starts running different code with your secrets in scope. A commit SHA cannot move.
# The fix
Reference third-party actions by full-length commit SHA, and keep the release tag in a trailing comment so humans can still read it:
uses: some-org/some-action/[full 40-char sha] # v4.1.2
First-party actions maintained by GitHub are lower risk, but pinning everything is simpler to reason about than maintaining two policies.
# Enforce it
GitHub offers policies at the repository and organization level to require actions pinned to a full-length commit SHA. Turn that on, so a future workflow edit cannot quietly regress to a tag.
# Checks
- Scan workflow files for uses lines ending in a version tag or a branch name. Each one is tech debt with a blast radius.
- Keep a process for updating pinned SHAs. A pinned action you never update is a different kind of risk.