Pin third-party Actions to commit SHAs, not tags

TL;DR

A pinned action you never update is a different kind of risk.

Steps

1. Reference third-party actions by full-length commit SHA, and keep the release tag in a trailing comment so humans can still read it:

uses: some-org/some-action/[full 40-char sha] # v4.1.2 First-party actions maintained by GitHub are lower risk, but pinning everything is simpler to reason about than maintaining two policies.

2. - Scan workflow files for uses lines ending in a version tag or a branch name. Each one is tech debt with a blast radius.

• Keep a process for updating pinned SHAs. A pinned action you never update is a different kind of risk.

When to use

You are seeing this: A tag is a moving pointer. Use this skill when you run into "Pin third-party Actions to commit SHAs, not tags".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: # v4.1.2. If you are on something much newer or older, the details may have shifted.

Why this happens

A tag is a moving pointer.

GitHub's security hardening guide notes that policies exist at the repository and organization level to require actions to be pinned to a full-length commit SHA. Source: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions