Plainwork / Catalogue / Pinfix
Pin GitHub Actions and Docker images in one step
Turn uses: actions/checkout@v4 into a full commit SHA and FROM node:22 into a sha256 digest, with the version kept as a comment. Free in VS Code and the command line. Pro ($9, one-time) pins whole repositories.
- Free: underline unpinned GitHub Actions and container images in VS Code, with a quick fix that pins the line
- Get the free tool: run npx @plainworkdigital/pinfix check or search Pinfix (plainwork.pinfix) in the VS Code Extensions view
- Free: pin a whole file, and an offline check for CI that exits 1 when anything is unpinned
- Pro: pin a whole folder or workspace in one command
- Pro: verify that version comments still match their SHAs and that image digests are current
- Pro: update pins to the newest release (same major by default), policy file and SARIF output
This is the output of pinfix pin Dockerfile on a Dockerfile with a Docker Hub, a GitHub Container Registry and a Microsoft Container Registry base image. The digests are what the registries returned (we compared all of them with docker buildx imagetools inspect and they matched). For actions, uses: actions/checkout@v4 becomes uses: actions/checkout@<40-character SHA> # v4.4.0.
Dockerfile line 1 - node:22-alpine + node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402 line 4 - ghcr.io/astral-sh/uv:latest + ghcr.io/astral-sh/uv:latest@sha256:4a1f3666816dafadd20ceb71eac9a7d56d7ef30279f7d64048519ab901ada336 line 5 - mcr.microsoft.com/dotnet/runtime:8.0 + mcr.microsoft.com/dotnet/runtime:8.0@sha256:60d11c2be381e7f90b8bd984472dd2432933858aba55087d5936980cf2071d5a 3 references would change. Run again with --write to save.
Made for
Who it's for
One gesture for actions and images
The same quick fix pins a uses: line, a Dockerfile FROM, a compose image: and a Kubernetes image: without switching tools.
The version stays readable
The SHA gets the most specific version tag on that commit as a comment (for example v4.4.0, not just v4), and images keep their tag, so humans and update bots can still read the file.
Private by design
Underlining reads only the open file. Nothing is looked up until you pick a fix, and then only the owner, repo and tag, or the image name, go to GitHub or the registry. No telemetry.
Honest about what it cannot do
Variables, private repositories and private images are skipped or reported, never guessed, a reference that cannot be resolved is left unchanged and reported, and `pin --write` on the command line saves nothing if any lookup fails.
What's inside
Everything you get
How it works
From checkout to done
Buy
Pay securely with Stripe.
Open
Your key page opens straight away: copy the key.
Use
Run pinfix activate with the key, or paste it into Pinfix: Enter Pro key in VS Code.
Questions
Good to know
How do I get the free tool?
Command line: npx @plainworkdigital/pinfix check (Node 18 or newer). VS Code: search Pinfix in the Extensions view, or install the id plainwork.pinfix. Both are free; Pro is an extra key you enter into them.
Is the free version really useful on its own?
Yes. Finding unpinned references, the quick fix, pinning a file, and the offline CI check are all free. Pro is for pinning, verifying and updating a whole repository at once, and for policy and SARIF.
What does it send anywhere?
Nothing leaves your machine until you choose a fix or command. Then only owner/repo and the tag (to api.github.com) or the image name and tag (to its registry) are sent, never file contents. There is no telemetry. Pro also sends your licence key to Plainwork's licence server, caches the answer for ten minutes, and works offline with the free features.
Will GitHub's rate limit stop me?
Anonymous GitHub requests are limited to 60 an hour. In VS Code, Pinfix uses your existing GitHub sign-in if there is one; on the command line it reads GITHUB_TOKEN. Each unique reference is looked up once and remembered for ten minutes. When the limit is hit it stops and says so.
Does pinning make an action safe?
No. A pin guarantees you run the same code every time. It does not review that code. Pin from a version you have already looked at, and keep pins moving with updates.
Which key do I use and where?
After payment you get a key starting with pw_d20261016a4_. Run pinfix activate followed by the key, or use the Pinfix: Enter Pro key command in VS Code. One key covers both.
Does it work in Cursor and other VS Code forks?
The command line tool works anywhere. The extension is published for VS Code only (not on Open VSX), so forks that use Open VSX cannot install it yet; use the command line tool there.
What if it doesn't work for me?
If it doesn't work as described or you can't access it, email us within 14 days and we'll fix it or refund you. See the refund policy for details.
Pinfix
Pin GitHub Actions to commit SHAs and Docker images to digests from your editor or CLI. Free quick fix, Pro key $9 one-time.
More from the catalogue
Other small tools
Store Text Draft
AI-written App Store and Google Play text from your facts: limits, store rules and keyword field handled; nothing invented.
Polyglot for Ghost
Multilingual Ghost on one install: routes, hreflang, language switcher, menus and strings, a patched Source theme and a CLI. One-time $29.
Mail Auth Fix Sheet
Your domain's SPF, DKIM and DMARC read from live DNS, with copy-paste records, your SPF lookup count and a dated rollout, in 24 hours.