Run any Skill in Manus with one click

gh-pin-actions

Stars3

Forks2

UpdatedApril 26, 2026 at 06:00

Update and pin GitHub Actions references in repository .github YAML files. Use when Codex needs to find unique workflow or composite-action uses entries, resolve each external action to its latest stable exact SemVer tag, and rewrite uses lines to commit SHA pins with version comments like owner/repo@40-character-sha

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

beeman

beeman/skills

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

File Explorer

3 files

SKILL.md

readonly

name	gh-pin-actions
description	Update and pin GitHub Actions references in repository .github YAML files. Use when Codex needs to find unique workflow or composite-action uses entries, resolve each external action to its latest stable exact SemVer tag, and rewrite uses lines to commit SHA pins with version comments like owner/repo@40-character-sha

Pin GitHub Actions

Workflow

Use the bundled script for the heavy lifting. Resolve the script path from this skill directory and pass the target repository root:

python3 scripts/pin_github_actions.py /path/to/repository

The script recursively scans .github/**/*.yml and .github/**/*.yaml, including .github/workflows, .github/actions, and nested directories. It updates only external GitHub action references shaped like owner/repo[/path]@ref; it skips local actions such as ./.github/actions/foo and Docker actions such as docker://....

Operating Rules

Let the script discover unique actions, fetch latest stable exact SemVer tags, resolve tags to commit SHAs, and rewrite files in one pass.
Run the script from the skill directory, or use the discovered skill directory path, and pass the repository root, .github directory, or specific YAML file as the target.
Use --dry-run first when the user asked to preview changes or when the repository is sensitive.
Use GITHUB_TOKEN in the environment when available to avoid GitHub API rate limits.
Review the diff after the script runs. The expected final line format is:

uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

Useful Commands

Preview changes:

python3 scripts/pin_github_actions.py /path/to/repository --dry-run

Allow prerelease tags when explicitly requested:

python3 scripts/pin_github_actions.py /path/to/repository --include-prereleases

Check whether files are already pinned without writing:

python3 scripts/pin_github_actions.py /path/to/repository --check

Failure Handling

If a repository has no stable exact SemVer tag, stop and report the action name; do not invent a version.
If GitHub API access fails, rerun with network permission or GITHUB_TOKEN.
If a uses: line has an unusual YAML shape the script skips, inspect it manually and keep the final uses: <action-name>@<hash> # <tag> format.

More from this repository

same repository

gh-commit

beeman/skills

Prepare a local Git commit from repo changes. Use when Codex needs to get onto the correct feature branch if needed, inspect `git status --short`, the current diff, and branch history, run the smallest relevant verification, add any required changeset, and package the tracked work into either a new commit or an explicitly approved amend flow before any push or PR step.

2026-05-023

gh-pr-review-comments

beeman/skills

Address GitHub pull request review comments on an existing feature branch. Use when Codex needs to fetch live PR review comments with gh, classify each comment as actionable, optional, or rejectable, apply only accepted fixes on the same branch, run a self-review pass for contradictions introduced by those fixes, and then either create a new commit or follow an explicitly approved history-rewrite path before pushing, resolving threads, and re-requesting review.

2026-04-303

feature-structure

beeman/skills

Use when reorganizing code around feature boundaries, splitting monolithic screen components or state hooks, deciding whether logic belongs in data-access, feature, ui, or child features, or moving orchestration out of prop-heavy UI files.

2026-04-223

gh-plan-review

beeman/skills

Review, challenge, pressure-test, or refine an implementation plan tied to a GitHub issue, GitHub PR, or active branch. Use when Codex needs to inspect the authoritative GitHub state and local repo context, run a scope challenge, identify material plan risks, surface real tradeoffs, and finish with a fixed review summary without mutating code or git state.

2026-03-303

gh-pr-create

beeman/skills

Create a GitHub pull request from local repo changes. Use when Codex must get feature-branch setup and local commit packaging from `gh-commit`, get approval before pushing, show the exact PR title and body that will be sent, handle single-commit and multi-commit branch flows explicitly, and open or update the PR with gh.

2026-03-303

gh-issue-kickoff

beeman/skills

Kick off work on a GitHub issue with gh. Use when Codex needs to start from the authoritative issue state and local codebase, fix only material issue gaps, and produce the first execution-ready implementation plan. For a deeper critique or tradeoff review of an existing plan, use `gh-plan-review`.

2026-03-173

name	gh-pin-actions
description	Update and pin GitHub Actions references in repository .github YAML files. Use when Codex needs to find unique workflow or composite-action uses entries, resolve each external action to its latest stable exact SemVer tag, and rewrite uses lines to commit SHA pins with version comments like owner/repo@40-character-sha

Pin GitHub Actions

Workflow

Use the bundled script for the heavy lifting. Resolve the script path from this skill directory and pass the target repository root:

python3 scripts/pin_github_actions.py /path/to/repository

Operating Rules

Let the script discover unique actions, fetch latest stable exact SemVer tags, resolve tags to commit SHAs, and rewrite files in one pass.
Run the script from the skill directory, or use the discovered skill directory path, and pass the repository root, .github directory, or specific YAML file as the target.
Use --dry-run first when the user asked to preview changes or when the repository is sensitive.
Use GITHUB_TOKEN in the environment when available to avoid GitHub API rate limits.
Review the diff after the script runs. The expected final line format is:

uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

Useful Commands

Preview changes:

python3 scripts/pin_github_actions.py /path/to/repository --dry-run

Allow prerelease tags when explicitly requested:

python3 scripts/pin_github_actions.py /path/to/repository --include-prereleases

Check whether files are already pinned without writing:

python3 scripts/pin_github_actions.py /path/to/repository --check

Failure Handling

If a repository has no stable exact SemVer tag, stop and report the action name; do not invent a version.
If GitHub API access fails, rerun with network permission or GITHUB_TOKEN.
If a uses: line has an unusual YAML shape the script skips, inspect it manually and keep the final uses: <action-name>@<hash> # <tag> format.