Action SHA Pinning - CI/CD Glossary Definition
Action SHA pinning references an action by full commit SHA so its code cannot change silently.
Action SHA pinning is referencing a third-party action by its full commit SHA (for example actions/checkout@<40-char-sha>) instead of a mutable tag, so the exact code cannot change under you.
Tags like @v4 can be moved to point at new code. Pinning to an immutable 40-character commit SHA guarantees the action you audited is the action that runs.
Example
.github/workflows/ci.yml
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0Related guides
Action (GitHub Actions) - CI/CD Glossary DefinitionAction (GitHub Actions): An action is a packaged, reusable unit of workflow automation referenced with `uses:…
Workflow Permissions - CI/CD Glossary DefinitionWorkflow Permissions: Workflow permissions set the access scopes granted to `GITHUB_TOKEN` via the `permissio…