How should I pin third-party GitHub Actions to a commit SHA for supply-chain security, and how do I keep the pins updated?

What it is: Workflows that reference an action by tag or branch (uses: owner/action@v4) run whatever that ref currently points to. Tags can be moved or deleted, so if an action repository or maintainer account is compromised, every workflow using the mutable ref can pick up malicious code with access to your secrets and token. Pinning to a full-length commit SHA makes the reference immutable. Am I affected: Any workflow with uses: lines that point at tags, branches or "main" for actions you do not control. Search the repository for "uses:" in .github/workflows and composite actions. Fix: 1. Replace each third-party reference with the full commit SHA of the release you reviewed, keeping the version in a comment, e.g. uses: owner/action@<full-40-char-sha> # v4.1.0. Take the SHA from the action's own repository, not from a fork, and make sure it is a real commit in that repository. 2. Keep the pins current: Dependabot (package-ecosystem: github-actions) and Renovate can propose updates to SHA-pinned actions with the version comment, so you review diffs rather than drifting. 3. Prefer actions from trusted publishers, review the action's source or changelog on upgrade, and minimise their number. 4. Restrict what runs: in organisation or repository Actions settings, allow only selected actions, and require SHA pinning where the setting exists. 5. Combine with least privilege: set the default GITHUB_TOKEN to read-only and grant permissions per job; avoid exposing secrets to steps that do not need them. 6. If a pinned action was later reported compromised, treat secrets available to runs that used the affected version as exposed: rotate them, and review recent runs. Verify: a search for uses: lines shows 40-character SHAs for third-party actions, and automated update PRs arrive for them. Sources: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates