actions-pinning
Inventory, classify, and pin every uses: reference in GitHub Actions workflows, composite actions, and reusable workflows to a verified commit SHA, then keep those pins fresh with Dependabot. Use when the user says "pin actions", "unpinned actions", "SHA pin", "supply chain for workflows", or invokes /actions-pinning. Do NOT use for permissions and injection hardening of workflow files (route to /oss-hygiene) or for CI run-time speed (route to /ci-optimize).
- Installs
- 53
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/paulnsorensen/git-gouda --skill actions-pinning- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads actions-pinning automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
actions-pinning
Pins every uses: reference in GitHub Actions workflows, composite
actions, and reusable workflows to a commit SHA, verifies each SHA
belongs to the claimed action repository, and keeps the pins current
with Dependabot.
This skill covers supply-chain pinning only. /oss-hygiene covers
Token-Permissions and Dangerous-Workflow hardening for the same
workflow files; /ci-optimize covers wall-clock speed. Run those
separately.
Protocol
1. Inventory
Run the bundled scanner against every workflow and composite/reusable workflow file:
python3 scripts/pin_check.py .
It walks .github/workflows/**, .github/actions/**, and every
action.yml or action.yaml manifest in the tree. It skips VCS and
dependency directories: .git, .hg, .svn, node_modules, .venv,
venv, __pycache__, dist, build, .tox, and target. It scans
vendor/, because a ./vendor/... reference can run a vendored action.
It prints a table of (file, line, action, ref, status) for every
uses: line and exits 1 when any reference is unpinned. Use --json
for machine-readable output when scripting the remaining steps.
The scanner uses regular expressions, not a YAML parser. It removes one
matching pair of surrounding quotes from each uses: value. It has two
known limits; check the workflow by hand when either applies:
- A
uses:line inside arun: |block scalar gives a false row. - A flow-style mapping such as
- {uses: owner/repo@v1}gives no row.
2. Classify
The scanner assigns one status per reference:
| Status | Meaning | Action needed |
|---|---|---|
pinned-sha | already a full 40-character commit SHA | none |
unpinned-tag | a tag-shaped ref such as v4 or v4.1.0 | resolve to a SHA |
unpinned-branch | a common branch name such as main | resolve to a SHA |
unpinned-ref | any other ref, such as release/v1; type unknown | resolve to a SHA |
unpinned-commit | a commit-like hex ref, such as a short SHA de0fac2 or an uppercase 40-character SHA | resolve to the full lowercase SHA |
missing-ref | no @ref at all | resolve to a SHA |
invalid-self-ref | a $/path self-repository reference with an @ref suffix | remove the @ref suffix |
local | a local ./path action or a $/path self-repository reference | skip — not a supply-chain risk |
docker | a docker://image reference | flag separately — SHA pinning applies to the image digest, not this scanner |
3. Resolve each ref to a commit SHA
For each unpinned-tag, unpinned-branch, unpinned-ref,
unpinned-commit, or missing-ref finding:
# Tag: the ref object is the commit (lightweight) or a tag object (annotated).
gh api repos/{owner}/{repo}/git/ref/tags/{tag} --jq '.object'
# Branch: the ref object is the commit directly.
gh api repos/{owner}/{repo}/git/ref/heads/{branch} --jq '.object.sha'
# Annotated tag: dereference the tag object to get the commit SHA.
gh api repos/{owner}/{repo}/git/tags/{tag_sha} --jq '.object.sha'
For an unpinned-ref, try the tags/ path first, then the heads/
path.
For an unpinned-commit, the tag and branch paths cannot resolve the
ref. Resolve it through the commits endpoint, which returns the full
lowercase SHA:
gh api repos/{owner}/{repo}/commits/{ref} --jq '.sha'
Impostor-commit check — always run before rewriting a pin. Confirm the resolved SHA actually belongs to the action's own repository, not a fork, a rewritten ref, or a spoofed value:
gh api repos/{owner}/{repo}/commits/{sha}
A 404 here means the SHA does not belong to that repository. Stop and re-resolve; do not write an unverified SHA.
Once verified, rewrite the line:
uses: owner/repo@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Keep the original tag as a trailing comment — it is the human-readable version marker; the SHA is the enforced pin.
4. Keep pins fresh with Dependabot
Add (or merge into an existing dependabot.yml) the github-actions
ecosystem entry in assets/dependabot-actions-snippet.yml. Dependabot
resolves tag bumps to new commit SHAs automatically and opens a PR
with the version comment updated — review and merge those PRs rather
than hand-editing pins later.
Version updates (not security updates) default to a 3-day
registry-availability cooldown as of 2026-07-14; a newly published tag
won't appear in a Dependabot PR until it clears that window. See
references/policy.md for the source.
For the full dependabot.yml scaffold across every ecosystem in the
repo, use /oss-hygiene — this skill only owns the github-actions
entry.
5. Repository and organization pinning policy
GitHub can enforce SHA pinning at the allowed-actions policy level (repo, org, or enterprise), including blocking specific actions outright. Read the current policy at the scope of the request before proposing any change:
# Repository scope.
gh api repos/{owner}/{repo}/actions/permissions
# Organization scope. Use this for an organization-wide request.
gh api orgs/{org}/actions/permissions
These are reads. Never call the corresponding write endpoints
(PUT repos/{owner}/{repo}/actions/permissions,
PUT orgs/{org}/actions/permissions, and the selected-actions /
allowed_actions variants) without the user's explicit authorization
for that specific change — policy changes can block other workflows
from running.
The SHA-pinning policy applies to actions only. Reusable workflows can still use a tag under that policy, so this skill pins reusable workflow references itself.
6. Flag mutable downloads inside workflow scripts
Regex pinning covers uses: only. While reading each workflow, also
flag (findings only, no rewrite) any run: step that fetches code
outside the pinned-action mechanism:
curl ... | shorcurl ... | bashpiping a remote script straight into a shell.wgetfrom a URL with no version or checksum.pip install package(ornpm install,gem install, ...) with no version pin.
These are supply-chain risk in the same family as an unpinned action, but fixing them is per-ecosystem and often changes build behavior — report them, do not rewrite them.
7. Optional: zizmor
If zizmor is installed, run it for a second opinion (it also checks
bot-conditions and composite-action internals this scanner does
not):
zizmor .github/workflows/
Skip silently if it is not installed — it is optional tooling, not a required gate.
8. Verify
Re-run the scanner after every rewrite batch:
python3 scripts/pin_check.py . && echo "all uses: references pinned"
Exit 0 with no unpinned-tag, unpinned-branch, unpinned-ref,
unpinned-commit, missing-ref, or invalid-self-ref rows means every
actionable reference is pinned. Report local and docker rows
separately — they are informational, not failures.
What this skill is NOT for
Token-PermissionsandDangerous-Workflowhardening (least-privilegepermissions:blocks,pull_request_targetrisk,${{ github.event.* }}interpolation into shell) — use/oss-hygiene.- CI run-time speed — use
/ci-optimize. - Choosing or writing the full
dependabot.ymlfor non-Actions ecosystems — use/oss-hygiene. - Applying an org-wide allowed-actions policy without the repo owner's explicit authorization for that specific write.
References
references/policy.md— cited primary sources foruses:syntax, SHA pinning, the allowed-actions policy, SHA resolution endpoints, the Dependabot cooldown, and zizmor.scripts/pin_check.py— the inventory/classification scanner used in steps 1, 2, and 8 (--self-testruns its embedded fixtures;--jsonfor machine-readable output).assets/dependabot-actions-snippet.yml— thegithub-actionsecosystem entry fordependabot.yml.
FAQ
What does the actions-pinning skill do?
Inventory, classify, and pin every uses: reference in GitHub Actions workflows, composite actions, and reusable workflows to a verified commit SHA, then keep those pins fresh with Dependabot. Use when the user says "pin actions", "unpinned actions", "SHA pin", "supply chain for workflows", or invokes /actions-pinning. Do NOT use for permissions and injection hardening of workflow files (route to /oss-hygiene) or for CI run-time speed (route to /ci-optimize).
How do I install actions-pinning?
Run npx skills add https://github.com/paulnsorensen/git-gouda --skill actions-pinning in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/actions-pinning/ (personal) or .claude/skills/actions-pinning/ (project).
Which AI agents can use actions-pinning?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is actions-pinning safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains actions-pinning?
It is published by paulnsorensen in paulnsorensen/git-gouda. It has 53 recorded installs.
More from paulnsorensen/git-gouda
config-review-bot
paulnsorensen/git-gouda
Audit or configure CodeRabbit repository review policy from effective sources. Use for CodeRabbit setup, configuration review, path coverage, or a specific pull-request review audit. Trigger on "configure CodeRabbit", "review .coderabbit.yaml", "set up CodeRabbit", "audit CodeRabbit settings", or "is CodeRabbit covering X". Keep audits read-only by default and separate schema validity, rule quality, and completed-review evidence. Do not use it to run a CodeRabbit CLI review or autofix, or to fix review comments on a pull request.
safe-settings
paulnsorensen/git-gouda
Set up GitHub's safe-settings (a Probot-based GitHub App from the github org) for declarative, org-wide repository policy as code. Use when the user says "settings as code", "safe-settings", "manage repos declaratively", "centralize repo settings", "org-level branch protection", "scaffold an admin repo", "github settings app", or invokes /safe-settings on an org that wants to manage repo settings, branch protection, rulesets, labels, teams, environments, and collaborators from one admin repo. Scaffolds the admin-repo layout (settings.yml + suborgs/ + repos/), the GitHub App installation steps, and a scheduled full-sync GitHub Actions workflow. Distinct from /gh-bootstrap (one-shot gh api config of a single repo) — this skill is for org-scale settings as code that reconciles continuously. Not for per-task GitHub ops (PRs, issues, CI status) or local git work — those are out of this catalog's scope.
gh-bootstrap
paulnsorensen/git-gouda
One-time GitHub repository configuration via the gh CLI: lock the default branch with PR and CI rules, optionally enable a supported merge queue, lock merging to squash-only with PR-title commit messages, scaffold automatically-generated release notes (.github/release.yml), and optionally add a tag-driven release workflow. Use when the user says "set up the repo", "configure the merge queue", "enable squash merging", "lock down main", "set up branch protection", "configure release notes", "scaffold releases", "set up release tagging", or invokes /gh-bootstrap on a fresh or loosely-configured GitHub repository. Idempotent — safe to re-run on already-configured repos to bring missing pieces in line. This skill covers one-time repo policy, not per-task GitHub operations, local git commands, or project task running.
prek
paulnsorensen/git-gouda
Onboard prek (Rust-powered pre-commit) into any project and suggest hooks tailored to the language/framework. Use when the user says "add prek", "set up pre-commit hooks", "configure prek", "what hooks should I use", or when you notice a project without a prek.toml that would benefit from pre-commit checks. Also trigger when the user wants to add new hooks to an existing prek.toml, audit their hook config, or migrate from pre-commit to prek. Covers Rust, Python, TypeScript/JavaScript, Go, Ruby, and Shell projects. Do NOT use for husky, lint-staged, or CI pipeline hook configuration — this skill is specifically for prek.
oss-hygiene
paulnsorensen/git-gouda
Bring an open-source GitHub repository up to community-standards and supply-chain hygiene baseline: scaffold the GitHub Community Standards files (README check, LICENSE, CODEOFCONDUCT, CONTRIBUTING, SECURITY, issue + PR templates), wire Dependabot version updates, the Dependency Review action, OpenSSF Scorecard, and CodeQL (when applicable), check Dependabot alerts and secret scanning, and add the OpenSSF Best Practices Badge link. Use when the user says "set up OSS hygiene", "make this repo open-source-ready", "add community health files", "wire dependabot", "add scorecard", "OSSF badge", "supply chain hardening", or invokes /oss-hygiene on a public repo. Idempotent — safe to re-run; diffs against templates and asks before overwriting. Distinct from /gh-bootstrap (merge-button + branch protection) and /safe-settings (org-scale settings as code): focuses on the contributor-facing and supply-chain surface, not merge or org policy. Run after /gh-bootstrap; before announcing the repo.
github-copilot-repo-instructions
paulnsorensen/git-gouda
Add, audit, or fix GitHub Copilot repository custom instructions — .github/copilot-instructions.md (repo-wide) and .github/instructions/.instructions.md (path-specific) — so Copilot Chat, Copilot code review, and the Copilot coding agent all pick up project-wide guidance. Also covers AGENTS.md, CLAUDE.md, and GEMINI.md as alternate agent instruction files. Use when the user says "add Copilot instructions", "set up copilot-instructions.md", "audit our Copilot config", "make Copilot follow our conventions", "configure Copilot code review", "add path-specific Copilot rules", "applyTo glob", "excludeAgent", "Copilot is ignoring our guidance", or invokes /github-copilot-repo-instructions. Do NOT use for personal (per-user) Copilot instructions; those are out of scope for this skill. For AGENTS.md authoring guidance beyond file layout, see the agents-md skill.
Popular devops & cloud skills
microsoft-foundry
microsoft/azure-skills
Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end. USE FOR: foundry, azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy/troubleshoot, prompt agent create, managed harness agent create, GitHub Copilot harness agent, create agent, update agent, add tool to agent, invoke agent, agent insights, evaluate agent, batch eval, continuous eval, continuous monitoring, agent CI/CD, optimize prompt, improve prompt, optimize agent instructions, Agent Optimizer scaffold, dataset curation from traces, deploy model, model fine-tuning (SFT/DPO/RFT), Foundry project, RBAC, role assignment, permissions, quota, capacity, region, deployment failure, AI Services, create Foundry resource, knowledge index, customize deployment, onboard, availability, training-data, grader, distillation, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure
azure-diagnostics
microsoft/azure-skills
Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target port mismatch, troubleshoot functions, function telemetry missing or stopped after a config/connection-string change, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures, resource health, root cause of errors, troubleshoot event hubs, troubleshoot service bus, messaging SDK error, AMQP connection failure, message lock lost, lock renewal during long-running processing, service bus dead letter.
azure-prepare
microsoft/azure-skills
Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.
azure-ai
microsoft/azure-skills
Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.
azure-deploy
microsoft/azure-skills
Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.
azure-validate
microsoft/azure-skills
Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment.