World map

 

BM

World C4: Pipeline Shields

Pin actions to a full SHA

You will learn: how to pin borrowed actions to a full commit SHA, and let Dependabot keep them fresh.

Checked with GitHub Actions 2026-10 on 31 Oct 2026

The problem

You pinned 12 borrowed actions to full SHAs. Safe! A month later, 3 of them fix security bugs. Your pins still run the old code. Who updates them?

Watch

GitHub’s advice: pin every third-party action to a full commit SHA. Use a tag only if you trust the maker. Sort these.

Drag a card into a box. Or tap the card, then tap the box.

      Try it

      Tap every line that a moved tag or branch could poison.

      Tap every risky line. Each one shows the attack and the fix.

      Workflow file .github/workflows/ci.yml

      Watch

      bash
      cat .github/dependabot.yml
      version: 2
      updates:
      - package-ecosystem: "github-actions"
      directory: "/"
      schedule:
      interval: "weekly"

      Meet your pin keeper: Dependabot: GitHub's helper that warns about unsafe packages and can open pull requests to update them.. This file asks it to check your actions every week. directory: "/" covers every file in .github/workflows.

      Try it

      A new version comes out. Put Dependabot’s steps in order.

      First step at the top. Put these in order. Use the arrows, or drag.

      • Dependabot sees that v2.1.0 is out
      • You read the release notes, then merge
      • It opens a PR: a new SHA and a new # v2.1.0 comment
      • Your CI runs on that PR

      Predict

      A stranger sends a PR. It changes @0123… # v2.0.0 to @89ab… # v2.1.0. How do you know the new SHA is real?

      Check

      Good pinning habit, or risky? Swipe each one.

      Swipe right for good, left for needs work. Or use the buttons.

      1 / 4

      Pin with the version in a comment: @<sha> # v2.0.0

      You did it!

      You can now pin actions to a full SHA and keep them fresh.

      Go deeper (optional)

      Dependabot alerts skip SHA pins: they only know version numbers. Version updates still work. GitHub is also testing workflow lockfiles (preview). They record the exact commit of every action, even nested ones. Real rep (optional):

      Real mission

      2. git add .github/dependabot.yml && git commit -m "Keep actions up to date" && git push

      0 of 4 steps done · Your ticks are saved.