| name | pin-workflows |
| description | Audits all .github/workflows/ action references, upgrades any that are behind the latest release, and pins every tag to its exact SHA commit hash for supply chain security. |
For every uses: line in every file under .github/workflows/:
- If the action reference uses a floating tag (e.g.
@v3, @v4, @v6) rather than a full SHA commit hash, it must be pinned.
- For each action that needs pinning:
a. Use
gh api repos/{owner}/{repo}/releases/latest to find the latest release tag.
b. If the currently used major version is behind the latest, upgrade to the latest release tag.
c. Use gh api repos/{owner}/{repo}/git/ref/tags/{tag} to resolve the tag to its commit SHA.
d. Replace the floating tag reference with the commit SHA and append the version as a comment, e.g. uses: actions/checkout@abc1234... # v6.0.2.
- Leave any reference that is already pinned to a full SHA alone unless its version is outdated — in that case resolve the latest tag's SHA and update both the SHA and the comment.
- After all files are processed, print a summary table of every change made (action, old ref, new ref).
