Pin GitHub Actions to SHA digests (zizmor unpinned-uses)

Pin GitHub Actions to SHA digests

Zizmor detected 9 unpinned-uses findings in .github/workflows/.

GitHub Actions referenced by tag (e.g. actions/checkout@v4) are vulnerable to tag mutation — a compromised or hijacked tag can introduce malicious code into CI runs. Pinning to a full commit SHA (e.g. actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4) eliminates this supply-chain risk.

Fix

Run pin-github-action to update all workflow files automatically:

npx pin-github-action .github/workflows/*.yml

Recommendations

• Dependabot: Add a .github/dependabot.yml with a github-actions entry so pinned SHAs are updated automatically when new Action versions are released.
• zizmor-action: Add zizmor-action for continuous workflow security scanning in CI.

References

• zizmor unpinned-uses audit
• pin-github-action

Opened by ds-security-scanning zizmor-cli-unpinned-uses

Start by reviewing the workflow files under .github/workflows/ and the 9 zizmor unpinned-uses findings. Run pin-github-action against .github/workflows/*.yml, then verify that all GitHub Actions use full commit SHAs and the zizmor audit reports no remaining unpinned uses.