hyland/GitHub Actions Ensure SHA Pinned Actions

Ensures all GitHub Actions use SHA-pinned versions instead of tag references

Trust Signals

name	description	required	default
allowlist	List of action patterns to exclude from SHA pinning (one per line). Supports wildcards with , e.g., 'owner/repo/' or 'owner/*'. Can also specify specific actions like 'owner/repo/action@v1.0.0'.	no	""
discovery	When set to 'true', only discovers and lists actions without making API calls. Faster execution but won't provide SHA conversion information. Ignored if dry-run is also set to 'true'.	no	true
dry-run	Controls execution mode. When 'true', reports what would be changed without making modifications. When 'false', makes actual file changes. Takes precedence over discovery mode. Requires GitHub token for API calls unless falling back.	no	true
github-token	GitHub token for API access. Uses GITHUB_TOKEN by default. Required for SHA resolution unless running in discovery mode.	no	${{ github.token }}
path	Path to search for GitHub Actions workflows and actions. Defaults to current repository root.	no	.

no outputs