Skip to content
Sarj Standards

Text · security

unpinned-github-action

text:unpinned-github-action

remote GitHub Action or container action without an immutable digest

Code
SARJ303
Default
error
Fix
none
Languages
config

Why

Mutable action tags can resolve to different code without a reviewed repository change.

Fix

Pin repository actions to a full commit SHA and container actions to a sha256 digest.

Before / after

Executed by this rule’s unit tests.

Before

A version tag is mutable

.github/workflows/ci.yml · focus
jobs:
  test:
    steps:
      - uses: actions/checkout@v4

After

A full action commit SHA is immutable

.github/workflows/ci.yml · focus
jobs:
  test:
    steps:
      - uses: actions/checkout@0123456789abcdef0123456789abcdef01234567

Limits

  • Only remote uses entries in .github/workflows YAML files are checked; local actions are excluded.

Files

.github/workflows/**/*.yaml.github/workflows/**/*.yml

References