Repository navigation
Compliance Category: Action SHA Pinning (3 findings) #360
Description
Compliance Category: Action SHA Pinning (3 findings)
Category: action-sha-pinning
Severity: error
Affected repos: .github-private (1 repo)
Summary
Three workflow files in .github-private use unpinned GitHub Actions instead of pinning to SHAs. Actions must be pinned to specific commits for security and reproducibility.
Affected Checks
| Workflow | Finding |
|---|---|
daily-pr-review-health.yml |
unpinned-actions-daily-pr-review-health.yml |
repair-pr-approvals.yml |
unpinned-actions-repair-pr-approvals.yml |
test.yml |
unpinned-actions-test.yml |
Remediation
Update each workflow file to pin all action references to specific commit SHAs instead of branch names (e.g., actions/checkout@e7e0efcc... instead of actions/checkout@main).
Reference: GitHub Actions Security - Pin to SHA
This issue was automatically created by the compliance audit and groups 3 action SHA pinning findings in .github-private.
Activity
don-petry commentedon May 27, 2026
Implementation Plan
Pin all GitHub Actions to commit SHAs in workflows:
Actions to pin:
repair-pr-approvals.yml(line 21):actions/checkout@v6.0.2→actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2test.yml(line 16):actions/checkout@v6.0.2→actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2daily-pr-review-health.yml(line 45):actions/cache@v5.0.5→actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f0 # v5.0.5Reference: Latest SHA mappings should be verified from the official action repositories or use
gh api repos/actions/<action>/releases/latest.don-petry commentedon May 29, 2026
Resolved! This check is now passing as of 2026-05-29. Closing automatically.