joshjohanning/Ensure Immutable Actions

Validates third-party actions in your workflows are using immutable releases

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 30, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: joshjohanning/ensure-immutable-actions@9f5dad6bb6148bd29ff0d874de6a8cc70af08fa9 # v2.6.2

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
github-token	GitHub token for API calls. The default github.token works for public repos. For recursion into private/internal repos, use a PAT or GitHub App token with contents: read scope.	yes	${{ github.token }}
fail-on-mutable	Fail the workflow if mutable actions are found	no	true
workflows	Specific workflow files to check (comma-separated filenames or glob patterns, e.g., ci.yml,deploy-*.yml). If not specified, checks ALL workflows in .github/workflows/	no	—
exclude-workflows	Workflow files to exclude from checks (comma-separated filenames or glob patterns, e.g., experimental-*.yml). Patterns containing / match the full workflow path without the @ref, e.g., owner/repo/.github/workflows/ci.yml. Applies even when workflows is specified and during recursive traversal of reusable workflows	no	—
include-first-party	Include first-party actions (actions/, github/, octokit/*) in immutability checks. When true, first-party actions are also checked and appear in mutable-actions/immutable-actions outputs in addition to first-party-actions.	no	false
write-job-summary	Controls job summary output. true: always write summary table, false: never write summary, on-failure-only: write summary only when checks find mutable or unsupported references.	no	true

Outputs

name	description
mutable-actions	JSON array of actions using mutable releases
immutable-actions	JSON array of actions using immutable releases
unsupported-actions	JSON array of action references that were found but not analyzed because their reference type is unsupported
first-party-actions	JSON array of all first-party actions with allowed and message fields indicating their status
all-passed	Boolean indicating if all checks passed
workflows-checked	List of workflow files that were checked