gh-pin-actions

Name: gh-pin-actions
Availability: InStock
Author: beeman

Pin external GitHub Actions references in YAML workflows to fixed SHAs and SemVer tags.

3|2|Updated Mar 15, 2026

Search Tags:#automation #yaml #semver #github-actions #workflows #ci #pinning

Ready to run

npx skills add https://github.com/beeman/skills --skill gh-pin-actions

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: gh-pin-actions
Source: https://github.com/beeman/skills/tree/main/gh-pin-actions
Command: npx skills add https://github.com/beeman/skills --skill gh-pin-actions

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Pin external GitHub Actions references in YAML workflows to fixed SHAs and exact SemVer tags for reliable, auditable CI.

Core Features & Use Cases

Discover external action uses across repository GitHub workflows and action configurations.
Resolve the latest stable exact SemVer tags for each action and pin to the corresponding commit SHAs with version comments for traceability.
Rewrite uses lines in place or provide diffs for review to ensure reproducible builds.

Quick Start

Use the gh-pin-actions skill to scan a repository and pin all external actions to their latest stable SHAs.

Frequently Asked Questions about gh-pin-actions

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I pin GitHub Actions to a specific commit SHA in YAML workflows?▼

To pin GitHub Actions in YAML workflows, this Skill scans .github/workflows, resolves the latest stable SemVer tags, and rewrites external action references to fixed commit SHAs with version notes.

Why should I pin GitHub Actions instead of using branch or tag references?▼

Pinning GitHub Actions to fixed SHAs ensures reliable, auditable CI by preventing unauthorized modifications to upstream action code, guaranteeing reproducible builds across your repository workflows.

Can I preview changes before pinning GitHub Actions in my repository?▼

Yes, you can use the dry-run mode to preview changes. The Skill will provide diffs for review, allowing you to verify the resolved SemVer tags and commit SHAs before rewriting your YAML files.

Does pinning GitHub Actions require a GitHub API token?▼

The Skill uses GitHub API tokens when available to resolve the latest stable exact SemVer tags and corresponding commit SHAs for each external action, ensuring accurate and authenticated lookups.

What is the best way to update pinned GitHub Actions to the latest stable release?▼

The best way to update pinned actions is to run this Skill to scan your workflows, resolve the latest stable exact SemVer tags for each action, and automatically rewrite them to the new commit SHAs.

Does this Skill scan nested action configurations inside .github/workflows?▼

Yes, it discovers external action uses across repository GitHub workflows and nested action configurations, resolving and pinning all references to their corresponding commit SHAs for full CI traceability.