gha-sha-reference

Pinning GitHub Actions to SHA references replaces unpinned tag references like `v4` with immutable commit SHAs to improve security and reproducibility. This skill automatically converts `uses: actions/checkout@v4` to `uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0`, appending the version tag as a comment for clarity.

SHA references prevent tag hijacking and ensure workflows always run the exact intended action version. Tags can be reassigned or deleted, but SHAs are immutable, protecting your CI/CD pipeline from unexpected changes or malicious updates to action repositories.

Run `pinact --check --diff` to identify all unpinned actions in `.github/workflows/*.yml` and `action.*.yml` files. This preview shows which `uses:` references need conversion without applying changes, letting you review the scope before proceeding.

Yes, the skill auto-detects and converts all applicable YAML files in `.github/workflows` and action configuration files. After previewing with `--check --diff`, run `pinact run` to apply SHA conversions across your entire workflow suite in a single operation.

The skill preserves readability by appending the version tag as a comment (e.g., `# v4.3.0`), so maintainers can still identify the action version at a glance while benefiting from SHA immutability and enhanced security.