lfreleng-actions/📌 Pinned Versions Action
Verifies action/workflow calls are pinned to SHA commit values
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 8, 2026
- License
- None
Pinned Snippet
uses: lfreleng-actions/pinned-versions-action@260e7b940fdf0f0c02b8ff6c7cce2dbeb5c7e7a8 # v0.2.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path_prefix | Directory location containing project code | no | . |
| no_checkout | Do not checkout local repository; used for testing | no | false |
| full_scan | Force a full repository scan even on pull_request events (default: pull_request events scan only changed workflow files) | no | false |
| linter_version | Optional gha-workflow-linter version to install from PyPI (e.g. '1.0.2'). When unset, uvx fetches the latest released version on each run. | no | "" |
Outputs
no outputs