How to Pin Actions to a Commit SHA in GitHub Actions

A full-length commit SHA pins an action to one immutable version, so a moved tag never changes what runs.

Replace floating tags like @v4 with the full commit SHA of the version you audited. The action resolves to exactly that commit, with a trailing comment noting the human-readable version.

Steps

• Find the commit SHA for the release you want to use.
• Replace @vN with @<40-char-sha> in uses:.
• Add a comment with the version so updates stay readable.

Workflow

steps:
  - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1
  - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b  # v4.0.3
    with:
      node-version: 20
  - run: npm ci && npm test

Gotchas

• Pinning to a SHA is primarily a security and reproducibility control; it also removes per-run tag resolution.
• Use Dependabot to bump pinned SHAs so you still receive security updates.

Related guides