pin-workflows

name	pin-workflows
description	Audits all .github/workflows/ action references, upgrades any that are behind the latest release, and pins every tag to its exact SHA commit hash for supply chain security. Use when this capability is needed.
metadata	{"author":"dbrennand"}

For every uses: line in every file under .github/workflows/:

1. If the action reference uses a floating tag (e.g. @v3, @v4, @v6) rather than a full SHA commit hash, it must be pinned.
2. For each action that needs pinning: a. Use gh api repos/{owner}/{repo}/releases/latest to find the latest release tag. b. If the currently used major version is behind the latest, upgrade to the latest release tag. c. Use gh api repos/{owner}/{repo}/git/ref/tags/{tag} to resolve the tag to its commit SHA. d. Replace the floating tag reference with the commit SHA and append the version as a comment, e.g. uses: actions/checkout@abc1234... # v6.0.2.
3. Leave any reference that is already pinned to a full SHA alone unless its version is outdated — in that case resolve the latest tag's SHA and update both the SHA and the comment.
4. After all files are processed, print a summary table of every change made (action, old ref, new ref).

---

Source: dbrennand/home-ops — distributed by TomeVault.