GitHub
Security & compliance
Releases
Third-party action pinned to mutable tag
Part of the Actions supply chain check · fix arrives as a guide
What it is
A workflow references a third-party action by tag or branch — uses: some/action@v3 — rather than by a full commit SHA.
Why it matters
Tags are mutable. The author, or anyone who compromises their account, can repoint v3 at new code, and your next CI run executes it with whatever secrets that job holds.
How to fix it
Pin to the full 40-character commit SHA and keep the version as a trailing comment for readability. Let Dependabot propose SHA bumps so upgrades stay reviewable.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.