ActionPin — SHA-pin lens for GitHub Actions

ActionPin shows, on GitHub itself, whether each action a workflow uses is pinned to a commit. A workflow line like "uses: some/action@v4" runs whatever commit that tag points to today. Tags and branches can be moved, so the code your pipeline runs can change without any change in your repository. Pinning to a full commit SHA closes that gap. ActionPin makes the difference visible while you read or review a workflow. What you see next to each "uses:" line - Pinned: the SHA is checked against the repository's tags, and the matching version is shown - Tag: flagged as mutable, with the commit it points to right now - Branch: flagged as risky, with its current tip - Wrong comment: a pinned SHA whose version comment names a tag that points somewhere else - Container image referenced by tag instead of digest One-click fix A panel lists every reference with a "Copy fix" button. It copies the pinned form, with the most specific version as a trailing comment so automated dependency updates keep working. Where it runs Any page on the site that shows workflow YAML, including pull request diffs. The toolbar badge shows how many references on the page are not pinned. Privacy No token, no account, no analytics. To resolve a tag, the extension requests the public ref list of the referenced repository, without cookies. Private action repositories are therefore reported as "not checked" rather than resolved. Limits ActionPin reads; it does not edit files or open pull requests. It cannot prove that an untagged commit belongs to the repository rather than a fork.