Repolode
Submit
suzuki-shunsuke

suzuki-shunsuke/pinact

A CLI that pins GitHub Actions and reusable workflows to full commit SHAs, and can update and verify their version comments.

View on GitHub
Stars
1,252
Forks
43
Open issues
33
Last commit
yesterday

What is it?

pinact edits GitHub workflow and composite action files so that each action or reusable workflow reference points to an immutable full-length commit SHA, with the original version kept as a trailing comment. Mutable tags such as v3 can be moved by their maintainers, so pinning to a SHA removes that supply-chain risk.

Beyond pinning, pinact can update pinned actions to newer versions, check whether files are already pinned without editing them, and verify that version comments match the pinned SHA. It also works offline with a check mode, supports GitHub Enterprise Server, and can read a GitHub token from the OS keyring or ghtkn.

CI pipelines can run pinact in check mode to fail builds that contain unpinned actions, and output SARIF for review tools such as reviewdog.

Key features

  • 01Pins GitHub Actions and reusable workflows to commit SHAs while keeping the version as a comment.
  • 02Checks pinning status without editing files, including an offline mode without the GitHub API.
  • 03Updates pinned actions, with an optional minimum release age.
  • 04Verifies that version comments match the pinned commit.
  • 05Includes and excludes specific actions and can pin only changed lines.
  • 06Outputs SARIF and supports GitHub Enterprise Server.

Use cases

  • Hardening CI workflows so third-party actions cannot change under you.
  • Enforcing pinned actions in CI with check mode that fails on unpinned references.
  • Keeping pinned actions up to date manually, for teams not using Renovate.
  • Gradually adopting pinning in a large repository by pinning only changed lines.

Quick start

  1. 1

    Install pinact (see INSTALL.md)

  2. 2

    Pin the actions of a repository

    pinact run
  3. 3

    Check pinning in CI without modifying files

    pinact run --check
  4. 4

    Set a GitHub token so API calls aren't rate limited

    export GITHUB_TOKEN=<your token>

Things to know

  • Without a GitHub access token, API calls are rate limited.

In collections

CLI & terminal toolsSecurity scanners, audits & threat intel toolsTesting frameworks & test automation tools

Topics

#github-actions#ci-cd#security#supply-chain#cli#devops-tooling#oss

FAQ

What is pinact?
A CLI that pins GitHub Actions and reusable workflows to full commit SHAs, and can update and verify their version comments. pinact edits GitHub workflow and composite action files so that each action or reusable workflow reference points to an immutable full-length commit SHA, with the original version kept as a trailing comment. Mutable tags such as v3 can be moved by their maintainers, so pinning to a SHA removes that supply-chain risk.
Is pinact free to use? What license does it have?
pinact is open source under the MIT license. Check the license terms before using it in commercial products.
Is pinact still maintained?
Actively maintained. The last commit to pinact was on Nov 6, 2026.
What can I use pinact for?
Hardening CI workflows so third-party actions cannot change under you. Enforcing pinned actions in CI with check mode that fails on unpinned references. Keeping pinned actions up to date manually, for teams not using Renovate. Gradually adopting pinning in a large repository by pinning only changed lines.
How do I install pinact?
Install pinact (see INSTALL.md) Pin the actions of a repository: pinact run Check pinning in CI without modifying files: pinact run --check Set a GitHub token so API calls aren't rate limited: export GITHUB_TOKEN=<your token>
Where can I get pinact?
The source code and installation instructions are on GitHub: https://github.com/suzuki-shunsuke/pinact

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects