GITHUB ACTIONS SECURITY
Trust your code.
Pin your dependencies.
Your workflow is only as secure as the actions it runs.
Find floating refs. Get exact SHAs. Close the gap.
Public repositories No installation Open source
your-workflow.yml•••
01steps:
02 - uses: actions/checkout@v4
Make it immutable
02 - uses: actions/checkout@11bd719…
Full 40-character SHA. No moving targets.
Start an audit
Just exploring? Take a look under the hood.
Audit results
READY WHEN YOU AREA clear view of your supply chain.
Run an audit to see which actions are pinned,
which can change, and exactly how to fix them.
01 Fetch workflows02 Inspect references03 Pin with confidence
01 / DISCOVER
Every workflow, in focus
Inspect default-branch workflows and referenced composites under .github/actions.
02 / CLASSIFY
Spot the moving targets
Separate immutable SHAs from floating tags, branches, and shortened references.
03 / REMEDIATE
Leave with a concrete fix
Copy resolved commit references into your workflows. Review, commit, and ship.