gha-sha-reference

What problem does it solve?

This skill automatically converts tag references in actions uses fields to immutable SHAs (with the version tag) to improve security and reproducibility.

Core Features & Use Cases

• Initial check: Identify unpinned actions with pinact --check --diff
• Conversion: Retrieve commit SHAs and append version tags as comments
• Automation: Update workflows in .github/workflows to pin actions
• Use case: Teams adhering to GitHub Actions security guidelines by ensuring all actions are pinned to a specific SHA.

Quick Start

例: uses: actions/checkout@v4 → uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 これを実行するには、まず pinact run --check --diff で対象を確認し、その後 pinact run で変換を適用します。