Skip to main content

Pin GitHub Actions to commit SHAs

org.openrewrite.github.security.PinGitHubActionsToSha

Replaces mutable tag or branch references in GitHub Actions uses: declarations with immutable commit SHAs. A static mapping of well-known actions is checked first; if the action is not found, the GitHub API is used to resolve the reference at recipe run time. By default only third-party actions are pinned; set pinOfficialActions to include actions from the actions and github organizations. To pin only a specific allow-list of actions, set includedActions.

Tags​

Recipe source​

GitHub: PinGitHubActionsToSha.java, Issue Tracker, Maven Central

This recipe is available under the Moderne Source Available License.

Options​

TypeNameDescriptionExample
BooleanpinOfficialActionsOptional. When set to true, also pins actions from official GitHub organizations (e.g., actions/*, github/*). Defaults to false, meaning only third-party actions are pinned.
StringgithubApiTokenOptional. A GitHub personal access token used to resolve tags/branches to commit SHAs via the GitHub API. Only needed for actions not found in the built-in static mapping. Without a token, unauthenticated requests are rate-limited to 60/hour.TODO Provide a usage example for the docs
ListtrustedOwnersOptional. Optional list of trusted owners/organizations, actions that belong to these organizations will not be pinned. This option overrides the 'Included actions' list.my-organization, my-other-organization
ListincludedActionsOptional. Optional allow-list of actions to pin. When provided, only uses: references matching one of these patterns are pinned; all other actions are left untouched. Patterns may be owner/repo (exact match), owner/* (any repo in an org), or owner/repo/subpath (exact match including a subpath). When omitted or empty, all third-party actions (and optionally official actions, per pinOfficialActions) are pinned.codecov/codecov-action

Example​

Parameters​
ParameterValue
pinOfficialActionsfalse
githubApiTokennull
trustedOwnersnull
includedActionsnull
Before​
.github/workflows/ci.yml
name: CI
on: push
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: codecov/codecov-action@v4
        name: Upload coverage
After​
.github/workflows/ci.yml
name: CI
on: push
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
        name: Upload coverage

Usage​

This recipe has no required configuration options. It can be activated by adding a dependency on `org.openrewrite.recipe:rewrite-github-actions` in your build file or by running a shell command (in which case no build changes are needed):

  1. Add the following to your build.gradle file:
    build.gradle
    plugins {
        id("org.openrewrite.rewrite") version("latest.release")
    }

    rewrite {
        activeRecipe("org.openrewrite.github.security.PinGitHubActionsToSha")
        setExportDatatables(true)
    }

    repositories {
        mavenCentral()
    }

    dependencies {
        rewrite("org.openrewrite.recipe:rewrite-github-actions:3.23.0")
    }
  2. Run gradle rewriteRun to run the recipe.

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

Source files that had results​

org.openrewrite.table.SourcesFileResults

Source files that were modified by the recipe run.

Column NameDescription
Source path before the runThe source path of the file before the run. null when a source file was created during the run.
Source path after the runA recipe may modify the source path. This is the path after the run. null when a source file was deleted during the run.
Parent of the recipe that made changesIn a hierarchical recipe, the parent of the recipe that made a change. Empty if this is the root of a hierarchy or if the recipe is not hierarchical at all.
Recipe that made changesThe specific recipe that made a change.
Estimated time savingAn estimated effort that a developer to fix manually instead of using this recipe, in unit of seconds.
CycleThe recipe cycle in which the change was made.