Action pin lookup: Commit SHAs for the GitHub Actions your workflows use
Paste the uses: lines from your GitHub workflows. Get each action pinned to the commit its tag points at today, as uses: owner/action@<sha> # v4.2.2 lines ready to paste, with a flag on branches and on version tags that have moved.
What it does
- Turns actions/checkout@v4 into a full commit SHA with the exact version as a comment
- Flags actions used by branch name, which change on every push
- Warns when an exact version tag points at a different commit than before (the tj-actions attack)
- Many lines at once, straight from your workflow file
- Dependabot snippet to keep the pins current
What goes in, what comes out
- What goes in
- Lines like uses: actions/checkout@v4 or owner/action/path@tag, up to 30 lines and 15 public repositories.
- What comes out
- uses: lines pinned to full commit SHAs with the version as a comment, whether each ref is a tag or a branch, unknown refs, and a warning when a tag has moved since an earlier lookup.
- Example
- actions/checkout@v4 gave uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 on 15 October 2026.
- Limits
- Public repositories on github.com only. 20 lookups a day per IP address without an account. A moved tag is only noticed for tags someone looked up here before. A pin says the code won't change under you; it doesn't say the code is safe.