---
title: "pin-github-actions"
description: "Blocks uses: of an action/reusable workflow at a movable ref (not a lowercase 40-hex SHA) and a docker:// image without @sha256, quoted, JSON or flow; an alias, escape or value off the uses line is refused. Local./ passe"
canonical: https://agentpluginsdirectory.com/plugins/pin-github-actions
last-updated: 2026-10-21
---

# pin-github-actions
Blocks uses: of an action/reusable workflow at a movable ref (not a lowercase 40-hex SHA) and a docker:// image without @sha256, quoted, JSON or flow; an alias, escape or value off the uses line is refused. Local./ passes. Scope:.github/workflows/,.github/actions/, action.y*ml. Line regex, no YAML parse: container image tags, impostor SHAs, a tag named as 40 hex pass. Waiver: 'pragma: allowlist unpinned-action' same line. Person's commit: honoured. Agent: only if in HEAD; MCP gateway: never.
- Slug: pin-github-actions
- Publisher: chock-core
- Repository: https://github.com/open-coder-ai/chock-catalog
- Manifest: .agents/policies/pin-github-actions/plugin.json
- Version: 0.0.6
- License: Apache-2.0
- Category (editorial): security
- Skills: 1 (pin-github-actions)
- MCP servers: 0
- Stars: 3
- Repository created: 2026-08-17
- Repository last pushed: 2026-10-21
- Publisher type: Organization
- Listing: https://agentpluginsdirectory.com/plugins/pin-github-actions
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## Skills

- pin-github-actions: The mechanizable slice of CI supply-chain hardening, enforced at two points: at commit (the git hook, over staged changes) and at agent tool-use (over a tool call's arguments, as the agent writes), a workflow that references a third-party GitHub Action by a movable ref, a branch or a version ta…

Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.