# Pinning and Trusting Third-Party Actions

> Stop running unvetted code in CI: pin third-party GitHub Actions to a full commit SHA, vet what you depend on, and keep pinned actions updated safely.

Source: https://latchkey.dev/learn/course-cicd/pinning-and-trusting-third-party-github-actions-tutorial  
Updated: 2026-06-26

A `uses:` line is `curl | bash` for your CI, so know exactly what you are running.

Every `uses: some/action@v3` in your workflow runs third-party code with access to your repository and token. A moving tag like `@v3` can be repointed to malicious code at any time. This lesson covers pinning actions to an immutable commit SHA, vetting what you depend on, and keeping pins current.

## The risk of a moving tag

Tags like `@v3` and branches like `@main` are mutable: the maintainer (or an attacker who compromises the account) can repoint them to new code. Your next run would execute that new code with your token and secrets. Pinning to a specific commit SHA freezes exactly the code you reviewed.

## Pin to a full commit SHA

Replace the tag with the full 40-character commit SHA, and keep the human-readable version in a trailing comment.

```.github/workflows/ci.yml
steps:
  - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  - uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v6.0.0
```

## Vet before you trust

- Prefer actions from verified creators or those you can read the source of.
- Check that the action is actively maintained and widely used.
- Minimize the number of third-party actions; fewer dependencies means less attack surface.
- Combine pinning with a least-privilege `GITHUB_TOKEN` so even a bad action is contained.

## Keep pins current

Pinning to a SHA is not "set and forget": you must update pins to get security fixes. Use Dependabot's GitHub Actions ecosystem to open pull requests that bump pinned SHAs, so you stay current without giving up immutability.

## FAQ

### Pinning and Trusting Third-Party Actions?

Every uses: some/action@v3 in your workflow runs third-party code with access to your repository and token. A moving tag like @v3 can be repointed to malicious code at any time. This lesson covers pinning actions to an immutable commit SHA, vetting what you depend on, and keeping pins current.

### The risk of a moving tag?

Tags like @v3 and branches like @main are mutable: the maintainer (or an attacker who compromises the account) can repoint them to new code. Your next run would execute that new code with your token and secrets. Pinning to a specific commit SHA freezes exactly the code you reviewed.

### Pin to a full commit SHA?

Replace the tag with the full 40-character commit SHA, and keep the human-readable version in a trailing comment.

### Keep pins current?

Pinning to a SHA is not "set and forget": you must update pins to get security fixes. Use Dependabot's GitHub Actions ecosystem to open pull requests that bump pinned SHAs, so you stay current without giving up immutability.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt