ihs7/Enforce Full SHA Commit Pinning in GitHub Actions
Enforces full SHA commit pinning for third-party actions
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| workflows-path | Path to workflows directory (searches recursively for all .yml/.yaml files) | yes | .github |
| fail-on-violation | Whether to fail the action when violations are found (default: true) | yes | true |
| exclude | Patterns to exclude from checking. Can be a comma-separated list or multi-line. | yes | "" |
Outputs
no outputs