Pin every external action and reusable workflow to a full commit SHA
Tag and branch refs are mutable, so a compromised upstream tag changes what runs in your workflow without a diff in your repo.
Observable check
every external uses: line in .github/workflows/, and in every action.yml or action.yaml the repository ships, including GitHub-owned actions and reusable workflows outside the current repository, resolves to a 40-character commit SHA. A composite action's steps take uses: exactly as a workflow job's steps do, so an action the repository defines is inside this rule and not only the workflows that call it.
Where this comes from
- https://docs.github.com/en/actions/reference/secure-use-reference
- https://github.com/ossf/scorecard/blob/main/docs/checks.md
- https://docs.github.com/en/actions/reference/workflows-and-actions/metadata-syntax
Last read against these sources on 2026-07-31.
GitHub: 'Pinning an action to a full-length commit SHA is currently the only way to use an action as an immutable release.' Scorecard Pinned-Dependencies agrees. The Check scoped itself to .github/workflows/ until 2026-07-31. The metadata syntax reference documents runs.steps[*].uses for a composite action, so an action.yml the repository ships can call an unpinned third-party action that no scan of the workflows directory would ever read. The Check now covers both.