Since they edited old tags here … maybe GitHub should have some kind of security...

CaliforniaKarl · 2025-03-15T02:11:39 1742004699

In your GitHub Actions YAML, instead of referencing a specific tag, you can reference a specific commit. So, instead of …

    uses: actions/checkout@v4

… you can use …

    uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

OptionOfT · 2025-03-15T02:27:07 1742005627

That still doesn't help when the action is a docker action only marked with a tag.

So you need to check the action.yml itself to see if it has a sha256 pinned (in the case it uses Docker).