Pin third-party Actions to commit SHAs, not tags

Why tags are a supply-chain risk

A tag is a moving pointer. If it gets reassigned, by compromise, mistake, or a maintainer going rogue, every workflow referencing it silently starts running different code with your secrets in scope. A commit SHA cannot move.

The fix

Reference third-party actions by full-length commit SHA, and keep the release tag in a trailing comment so humans can still read it: uses: some-org/some-action/[full 40-char sha] # v4.1.2 First-party actions maintained by GitHub are lower risk, but pinning everything is simpler to reason about than maintaining two policies.

Enforce it

GitHub offers policies at the repository and organization level to require actions pinned to a full-length commit SHA. Turn that on, so a future workflow edit cannot quietly regress to a tag.

Checks

• Scan workflow files for uses lines ending in a version tag or a branch name. Each one is tech debt with a blast radius.
• Keep a process for updating pinned SHAs. A pinned action you never update is a different kind of risk.

GitHub's security hardening guide notes that policies exist at the repository and organization level to require actions to be pinned to a full-length commit SHA. Source: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions