---
title: "pin-github-actions"
description: "The mechanizable slice of CI supply-chain hardening, enforced at two points: at commit (the git hook, over staged changes) and at agent tool-use (over a tool call's arguments, as the agent writes) -- a workflow that refe"
canonical: https://agentpluginsdirectory.com/plugins/pin-github-actions--open-coder-ai-org
last-updated: 2026-09-08
---

# pin-github-actions
The mechanizable slice of CI supply-chain hardening, enforced at two points: at commit (the git hook, over staged changes) and at agent tool-use (over a tool call's arguments, as the agent writes) -- a workflow that references a third-party GitHub Action by a movable ref -- a branch or a version tag -- instead of a full 40-character commit SHA. A tag like v4 or a branch like main can be re-pointed at new code after review, so the action that runs tomorrow need not be the one that was audited today; a compromised or rug-pulled release rides in on exactly that mutability. The gate blocks an added line that references an action by a non-SHA ref (owner/repo at a tag/branch); a full 40-char SHA pin passes, local actions (no ref) pass, and 'pragma: allowlist unpinned-action' on the same line is a visible, deliberate exception. This is the OpenSSF Scorecard Pinned-Dependencies control for the slice a diff can show; signature and provenance verification stay out of scope.
- Slug: pin-github-actions--open-coder-ai-org
- Publisher: chock-core
- Repository: https://github.com/open-coder-ai-org/chock-catalog
- Manifest: .agents/policies/pin-github-actions/plugin.json
- Version: 0.0.2
- License: Apache-2.0
- Category (editorial): other
- Skills: 1 (pin-github-actions)
- MCP servers: 0
- Stars: 1
- Listing: https://agentpluginsdirectory.com/plugins/pin-github-actions--open-coder-ai-org
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json