---
title: "pin-github-actions"
description: "Pre-commit gate for the mechanizable slice of CI supply-chain hardening: a workflow that references a third-party GitHub Action by a movable ref -- a branch or a version tag -- instead of a full 40-character commit SHA. "
canonical: https://agentpluginsdirectory.com/plugins/pin-github-actions
last-updated: 2026-08-27
---

# pin-github-actions
Pre-commit gate for the mechanizable slice of CI supply-chain hardening: a workflow that references a third-party GitHub Action by a movable ref -- a branch or a version tag -- instead of a full 40-character commit SHA. A tag like v4 or a branch like main can be re-pointed at new code after review, so the action that runs tomorrow need not be the one that was audited today; a compromised or rug-pulled release rides in on exactly that mutability. The gate blocks an added line that references an action by a non-SHA ref (owner/repo at a tag/branch); a full 40-char SHA pin passes, local actions (no ref) pass, and 'pragma: allowlist unpinned-action' on the same line is a visible, deliberate exception. This is the OpenSSF Scorecard Pinned-Dependencies control for the slice a diff can show; signature and provenance verification stay out of scope.
- Slug: pin-github-actions
- Publisher: chock-core
- Repository: https://github.com/open-coder-ai/chock-catalog
- Manifest: .agents/policies/pin-github-actions/plugin.json
- Version: 0.0.1
- License: Apache-2.0
- Category (editorial): security
- Skills: 1 (pin-github-actions)
- MCP servers: 0
- Stars: 1
- Listing: https://agentpluginsdirectory.com/plugins/pin-github-actions
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json