yosifkit/Verify Action SHA Pins
Verifies that pinned GitHub Action SHAs belong to the upstream repository and match expected tags.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| workflows | A space-separated list of file paths or globs to check. | no | .github/workflows/*.yml .github/workflows/*.yaml |
| require_sha | If true, fails if an action uses a tag/branch instead of a 40-character SHA. | no | false |
| require_comment | If true, fails if a pinned SHA does not have a commented expected tag/branch. | no | false |
| filter_changed_on_pr | If true, only checks workflow files that were modified in the current pull request. Does not affect non-PR workflows. | no | false |
| github_token | GitHub token for querying the REST API. | yes | ${{ github.token }} |
Outputs
no outputs