github-actions-sha-pinned

GitHub Actions uses: refs are pinned to a 40-character commit SHA with a # vN comment.

Runs under: @noctcore/harness lint-meta, not ESLint · Factory: createGithubActionsShaPinnedRule from @noctcore/lint-meta-rules · Category: ci · Fails CI by default: yes

Why

A tag or branch ref is a moving target: whoever controls the action’s repository can repoint it, and the new code runs with your workflow’s token. A full commit SHA cannot move. The trailing # vN comment keeps the pin readable and is what Dependabot rewrites on a bump, so a bare SHA is rejected too.

What it flags

Every uses: line (step-level and job-level reusable workflow calls) in the scanned workflow files:

• a ref whose pin is not a 40-character hex SHA (tags, branches, short SHAs, no @ at all),
• a SHA-pinned ref with no # vN comment,
• a docker:// ref with no @sha256:<digest>.

Each violation carries the 1-indexed line.

# Bad
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803

# Good
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- uses: ./.github/actions/setup

What it does not flag

• Local actions (uses: ./path).
• A full 40-character SHA with a # vN comment, quoted or not, including a path inside the action repo (github/codeql-action/analyze@<sha> # v3).
• A docker:// ref pinned by @sha256:<digest>.

The check is line-based text, not a YAML parse. A uses: value split across lines, or built from an expression, is not seen.

Options

createGithubActionsShaPinnedRule(options?: GithubActionsShaPinnedOptions): IMetaRule

Option	Type	Default	Meaning
workflowGlobs	string[]	['.github/workflows/*.yml', '.github/workflows/*.yaml']	Workflow files to scan.
ciCritical	boolean	true	Whether a violation fails CI.

When not to use it

If your repo has no GitHub Actions workflows, or you accept tag refs and review action updates some other way, skip it.