lfreleng-actions/📌 Pinned Versions Action

Verifies action/workflow calls are pinned to SHA commit values

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Activelast commit Jul 8, 2026
License
None

Pinned Snippet

workflow.ymlSHA-pinned
uses: lfreleng-actions/pinned-versions-action@260e7b940fdf0f0c02b8ff6c7cce2dbeb5c7e7a8 # v0.2.1

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
path_prefixDirectory location containing project codeno.
no_checkoutDo not checkout local repository; used for testingnofalse
full_scanForce a full repository scan even on pull_request events (default: pull_request events scan only changed workflow files)nofalse
linter_versionOptional gha-workflow-linter version to install from PyPI (e.g. '1.0.2'). When unset, uvx fetches the latest released version on each run.no""

no outputs