Skip to content

GitHub Actions - Unpinned Action

A uses: reference that points at a tag or a branch is mutable: whoever owns the action can move that tag or branch to different code at any time, and the next run of your workflow executes code nobody on your team reviewed. Because actions run inside your pipeline with access to its secrets and its token, a moved tag is a direct path into your build.

A reference pinned to a full 40-character commit SHA always resolves to the same code, so an update becomes an explicit, reviewable change to your workflow file.

What is checked

Boost Security raises one finding per unpinned reference, at the file and line of the uses: key, in your repository's own:

  • workflow files under .github/workflows/, covering both step-level uses: and job-level calls to reusable workflows
  • composite action definitions — any action.yml or action.yaml in the repository

References found inside a third-party action that your repository consumes are not evaluated — only the files your repository owns. An action reference passed as an input to another action (a uses: key nested under with:) is a value, not a reference the workflow resolves, and is not flagged.

Examples

Insecure Example

Every reference below can change under you without the workflow file changing:

name: build
on: push

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v4.1.1
      - uses: actions/upload-artifact@main
      - uses: some-vendor/deploy@abcdef1

  release:
    uses: other-org/repo/.github/workflows/release.yml@main

Secure Example

Each reference resolves to one immutable revision, with the human-readable version kept as a trailing comment:

name: build
on: push

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v5.0.0
      - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.1.1
      - uses: ./.github/actions/local-setup

  release:
    uses: other-org/repo/.github/workflows/release.yml@0f4a1c2d7e6b9a3c5d8e1f4b7a0c3d6e9b2f5a8c

The same rule applies to a composite action, where the steps of your own action.yml must be pinned too:

name: local-setup
runs:
  using: composite
  steps:
    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
      shell: bash

Accepted forms

Reference Pinned Why
actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 Yes Full 40-character commit SHA
actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v5.0.0 Yes A trailing version comment is accepted, so pinned references stay readable
docker://alpine@sha256:beb9b6d5e2e1c1f0f4c5cd9dcbb9e0ba3b3f4e37cbb4b0aa4b3d0d6b0b6e2a41 Yes An image digest is immutable
./.github/actions/local-setup Yes A local reference comes from the repository itself and has nothing to pin
actions/setup-node@v4, actions/cache@v4.1.1 No Tags can be moved, including fully qualified ones
actions/upload-artifact@main No Branches move with every push
some-vendor/deploy@abcdef1 No A short SHA is an abbreviation, not an immutable identifier
other-org/repo/.github/workflows/ci.yml@main No Reusable workflow calls are pinned the same way as actions

A docker:// reference that carries a tag rather than a digest — docker://alpine:3.19 — is not flagged, even though the tag is mutable.

Mitigation Steps

  • Replace the mutable reference with the full 40-character commit SHA of the release you intend to run. Both the GitHub UI and git ls-remote give you the SHA behind a tag.
  • Keep the version as a trailing comment (@<sha> # v5.0.0) so reviewers can still read the workflow at a glance.
  • Let Dependabot keep the pinned references current: it opens pull requests that move the SHA and update the comment together.
  • Pin composite actions and reusable workflow calls as well — they run with the same access as any other step.
  • Before pinning a third-party action, review the revision you are about to pin, since it is the code you will run until you change it deliberately.

More information