Replace unpinned GitHub Actions tags with commit SHAs using git ls-remote.
npx skills add https://github.com/dallay/cvix --skill pinned-tag
Please help me install this Agent Skill. Skill: pinned-tag Source: https://github.com/dallay/cvix/tree/main/.agents/skills/pinned-tag Command: npx skills add https://github.com/dallay/cvix --skill pinned-tag
Pinning GitHub Actions tags to specific commit SHAs prevents mutable references from breaking builds and reduces supply-chain risk.
Use this skill to pin a v2 action to its commit SHA in your workflow.
High-intent search queries and answers about installing and using this skill.
Pin GitHub Actions tags by resolving them to their corresponding full commit SHAs using git ls-remote, then replacing mutable references in your CI workflows to enforce immutability.
Pinning GitHub Actions to specific commit SHAs prevents mutable references from breaking builds and reduces supply-chain risk across your repository workflows and dependency manifests.
Scan workflows for unpinned tags by auditing manifest and workflow files to identify unpinned tags and report potential supply-chain risks associated with mutable references.
Yes, you can update dependency manifests across multiple repositories. The skill applies to CI workflows and dependency manifests across repositories, replacing tags with verified commit SHAs.
The skill verifies a resolved SHA belongs to the expected tag by using git ls-remote to resolve the tag and checking the resolved commit SHA before applying any workflow changes.
openkaidenResolve GitHub Actions tags to immutable commit SHAs for workflow steps.
florianbuetowScan project dependencies for CVEs, unpinned versions, and typosquatting risks.
CenredJunAutomate and validate CI/CD pipelines and infrastructure-as-code configurations.
multigresPin upstream multigres image tags to operator release SHAs in image_defaults.go.
