actions-pin - Safely upgrade pinned GitHub Actions
Audits and upgrades SHA-pinned GitHub Actions with an age-based supply-chain quarantine and fallback to the newest eligible release.
Tags
Updated: 2026-10-08Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Audit SHA-pinned Actions
- Parse upgrade arguments
- Query action releases
- Apply age quarantine
- Select eligible release pins
- Verify major-version inputs
- Update action references
- Update the pin lockfile
- Check pin consistency
Inputs
- Upgrade arguments
- GitHub Actions workflow files
- Composite action files
- Actions pin lockfile
- GitHub release metadata
- GitHub authentication token
Outputs
- Updated workflow pins
- Updated composite action pins
- Updated actions pin lockfile
- Held or skipped action report
- Pin consistency status
Requirements
- GitHub token
- GitHub API access
- Git and git ls-remote
- gh CLI
- make-based runner
- Go toolchain or mise-managed Go