# Pinning GitHub Actions

DevFeed: [Pinning GitHub Actions](<https://devfeed.tech/articles/pinning-github-actions-37823.md>)

Original publisher: [Read original article](<https://carlosbecker.com/posts/pinning-github-actions/>)

Author: Carlos Alexandro Becker

Published: 2025-11-17T00:00:00Z

Content type: tutorial

Language: en

Sources: [Carlos Becker](<https://devfeed.tech/sources/carlos-becker.md>)

Topics: [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Security](<https://devfeed.tech/topics/security.md>), [supply chain attacks](<https://devfeed.tech/topics/supply-chain-attacks.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [Dependabot](<https://devfeed.tech/topics/dependabot.md>)

Tags: [also](<https://devfeed.tech/tags/also.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [commit](<https://devfeed.tech/tags/commit.md>), [dependabot](<https://devfeed.tech/tags/dependabot.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>), [workflow](<https://devfeed.tech/tags/workflow.md>)

## AI overview

This tutorial explains why GitHub Actions should be pinned to full commit SHAs instead of mutable tags or branches. It describes the security and auditability benefits and introduces caarlos0/pinata, a tool that automates pinning and creates pull requests for review.

## Source excerpt

If you're using GitHub Actions in your projects, you should be pinning your actions to specific commit SHAs instead of using tags or branches.