Pinning GitHub Actions for Reproducibility and Security

Source: Dev.to

Why version tags can be unsafe

Version tags like actions/checkout@v5 are mutable—maintainers can move them, re‑release them, or even force‑push. This means your workflow could end up running different code tomorrow without any change on your side.

Pin to a commit SHA

Pinning an action to a specific commit SHA guarantees that the exact same code is used every time.

# Get the SHA for a specific tag (e.g., v5.0.1)
gh api repos/actions/checkout/commits/v5.0.1 --jq '.sha'

Then reference the SHA in your workflow:

- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

For a deeper dive, read the full article.