gitgithubgithub-actions

How do I pin an action to a specific SHA?

A warning is appearing in my IDE indicating that my action should be pinned to a specific SHA. I understand SHAs from Git commits, but how do I track down the SHA for GitHub Actions?

Fake Example: mycoderepo/mylibrary-action@v2

Real Example: github/codeql-action/upload-sarif@v3

This is what I found on GitHub regarding the secure use of third-party actions:

Pin actions to a full length commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Solution

  • The action name is simply a pointer to a GitHub repository under a GitHub organization. The first part of the name before / is the organization, whereas the second part is the repo:

    Longer paths represent folders inside the repo:

    The remaining portion of the name prefixed by a @ represents the commit identifier. It is generally in the form of a tag @v3 but it could also be a specific SHA:

    In fact, a tag is simply a pointer to a specific SHA:

    To detect the specific SHA, you simply need to:

    1. Determine the appropriate repo name, from the action (as explained above)
    2. Visit the repo on GitHub
    3. Click on the branch/tag switcher to locate the tag you are interested in
    4. Copy the short (or full) SHA from the referenced commit

    branch/tag switcher

    SHA version for the commit