update-github-action

To pin GitHub Actions to immutable commit SHAs, this Skill resolves mutable action tags by querying repository release metadata via the GitHub CLI and updates workflow steps with the specific commit SHA. It maintains a consistent version comment format for auditability and Dependabot compatibility.

Using commit SHAs instead of tags in GitHub Actions workflows prevents silent dependency changes from mutable tags. Pinning to immutable commit SHAs ensures workflow stability and security hardening by guaranteeing the executed code does not change unless manually updated.

Yes, you need the GitHub CLI installed to resolve action tags to immutable commit SHAs. The Skill requires the GitHub CLI to query repository release and git reference metadata for accurate SHA pinning during CI/CD maintenance.

Yes, you can automate CI/CD security hardening for existing repository workflows. The Skill fetches the latest commit SHA for any GitHub Action, formats the uses line, and applies version tracking comments to prevent unauthorized dependency modifications.

The best way to track GitHub Action versions after pinning to a commit SHA is to maintain a consistent version comment format. This Skill automatically applies this format to ensure auditability and seamless compatibility with Dependabot updates.