GitHub Actions SHA pinning checker

Paste a workflow, a Dockerfile or a compose file. The page lists every reference that is not pinned to an immutable commit SHA or digest, and can rewrite the GitHub Actions lines for you. The text you paste stays in your browser.

What this does, and what it does not

A tag such as v4 or a branch such as main can be moved by whoever controls the repository, so a workflow that uses it runs whatever the tag points at today. GitHub's own guidance is to pin to a full-length commit SHA, and since August 2025 an organisation can make workflows fail when an action is not pinned. The finder works offline on the text you paste. The pin button sends only owner/repo and the tag or branch name of each action to api.github.com, using GitHub's "get a commit" API, and writes the result back with the version as a comment.

The page is limited by GitHub's rate limit for anonymous requests (60 an hour). Private repositories cannot be looked up, and a variable in a reference (${{ ... }}) is skipped, not guessed. A pin proves you run the same code tomorrow, not that the code is safe, so pin from a version you have already reviewed.

Whole repository, images and CI

For container images, workflow folders and CI, use the free command line tool: npx @plainworkdigital/pinfix check lists unpinned references with no network, and pinfix pin <file> pins one file. The VS Code extension adds a quick fix on the exact line. Pinfix Pro pins a whole folder at once, verifies that version comments still match their SHAs, and updates pins.