iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Replace mutable action tags and branches with the exact 40-character commit SHA you have reviewed. A full SHA makes the workflow fetch that commit instead of whatever code a tag or branch points to later. It does not certify the action’s safety, so verify the repository and release, grant only necessary permissions, and schedule deliberate updates.
What a full-length SHA pin changes
A workflow reference such as actions/checkout@v4 selects a tag. The tag is a human-friendly label, but its owner can move it to another commit or delete and recreate it. A branch reference follows the branch’s current tip, so every run can potentially receive new code.
A full-length commit reference selects one exact Git commit. GitHub’s secure-use guidance states: “Pinning an action to a full-length commit SHA is currently the only way to use an action as an immutable release.” The SHA must contain all 40 hexadecimal characters; an abbreviated SHA does not provide the same guarantee.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Reference | What the workflow follows | Do upstream changes arrive automatically? | Maintenance burden |
|---|---|---|---|
owner/repository@v4 (tag) |
A named release tag that may be moved or deleted | Yes, if the tag is moved | Low initially; less predictable over time |
owner/repository@main (branch) |
The branch’s current commit | Yes, whenever the branch advances | Low initially; highest change exposure |
owner/repository@COMMIT_SHA (full SHA) |
One specific 40-character commit | No | Deliberate review and update work required |
Pinning therefore addresses reference mutability, not code quality. A malicious, compromised, or vulnerable commit remains malicious, compromised, or vulnerable after you pin it. Treat the selected source as a dependency that requires provenance checks, code review, permissions review, and ongoing updates.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Choose the commit for the release you intend to run
Start from the action’s own repository
Open the official repository named by the action, not a similarly named fork. Locate the release or tag your team has evaluated, then inspect the commit to which that release points. Confirm that the commit is in the action’s repository and that its history and contents match the release you approved.
Do not copy an SHA from an old blog post or an example without checking the release. Action maintainers publish new commits, and a value that was correct for one release may select a different or nonexistent revision later.
Verify before granting access
Review the action’s source, build and release process, and the permissions it requests. Pay particular attention when the workflow exposes repository contents, write tokens, cloud credentials, signing keys, or other secrets. Pinning prevents a later tag movement from silently changing the selected code; it does not replace a security review of the commit you chose.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsResolve the tag to a complete commit ID
Git can show the commit behind a tag without requiring you to guess the value. For a remote repository, run a command like this locally, substituting the repository and tag you have reviewed:
git ls-remote https://github.com/OWNER/REPOSITORY.git refs/tags/v4The result includes the object ID for that tag. If the project uses annotated tags, inspect the tag and the commit it identifies, then use the complete 40-character commit ID that represents the release code you intend to execute. Check the same value in the repository’s release or commit view before copying it into workflow YAML.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Keep a record of the release name, commit ID, review date, and reviewer. That record lets a later update review distinguish an intentional upgrade from an unexplained reference change.
Change a workflow from a tag to a SHA
Before: a movable tag
name: CI
on:
push:
pull_request:
jobs:
test:
runs-on: ubuntu-latest
steps:
- name: Check out source
uses: actions/checkout@v4After: a full commit reference with a release comment
name: CI
on:
push:
pull_request:
jobs:
test:
runs-on: ubuntu-latest
steps:
- name: Check out source
uses: actions/checkout@COMMIT_SHA_FROM_THE_REVIEWED_RELEASE # v4.0.0Replace COMMIT_SHA_FROM_THE_REVIEWED_RELEASE with the actual 40-character value you verified. It is shown as a symbolic token here because release SHAs change; using an invented or abbreviated value would not pin a real action.
The comment is optional and does not affect execution. The SHA determines what GitHub fetches. A same-line version comment records the human-intended release and supplies version information that makes reviews and Dependabot pull requests easier to understand.
Pin every external action in the file
Search all workflow files under .github/workflows/ for uses:. Pin each third-party action, including actions in job steps that are easy to overlook. Review composite actions and nested workflow calls as well; pinning the top-level workflow does not automatically pin dependencies it invokes.
Do not assume that a version comment makes a reference immutable. A line such as uses: owner/repository@COMMIT_SHA # v4 remains pinned only because of the SHA.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Reusable workflows need the same treatment
Third-party reusable workflows are dependencies too. Apply the same full-SHA rule to a call such as:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
jobs:
deploy:
uses: owner/repository/.github/workflows/deploy.yml@COMMIT_SHA_FROM_THE_REVIEWED_RELEASE
secrets: inheritReview the called workflow’s permissions, environments, inputs, and secret handling before approving the commit. A reusable workflow can perform privileged operations on behalf of the caller, so its provenance matters as much as that of an individual action.
Same-repository reusable workflows
A workflow that calls another workflow in the same repository can use a relative path such as ./.github/workflows/reusable.yml. GitHub’s current documentation describes this form as resolving to the repository at the commit that is running. It is a different case from pinning a third-party repository by SHA, and the syntax is not available on GitHub Enterprise Server. Check the documentation for the GitHub product you operate before standardizing on it.
Understand the security boundary
What pinning protects against
- A maintainer moving a release tag after your workflow was approved.
- A branch advancing between two runs and silently changing the fetched code.
- Ambiguity about which revision an audit or incident review actually executed.
What pinning does not prove
- That the commit was authored by the expected maintainer or built from trusted source.
- That the code is free of vulnerabilities or malicious behavior.
- That transitive dependencies, downloaded tools, or artifacts used by the action are safe.
- That the workflow has least-privilege permissions or protects its secrets correctly.
Use repository ownership checks, commit and release review, restricted GITHUB_TOKEN permissions, environment approvals, and secret minimization alongside SHA pinning. A fixed reference narrows one supply-chain change path; it is not a vulnerability scanner or a complete workflow-hardening program.
Keep pinned actions current with Dependabot
Why updates become deliberate
GitHub says a SHA-pinned action does not automatically receive upstream bug fixes or security updates. That immutability is the trade-off: your workflow stays on the reviewed commit until someone chooses and reviews a newer one.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Dependabot version updates can update GitHub Actions references. Add a configuration file at .github/dependabot.yml with the github-actions ecosystem and a schedule appropriate to your risk and release cadence:
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"The documented directory: "/" setting covers workflow files in the repository’s standard location. Review each pull request rather than merging reference changes blindly. Confirm that the proposed SHA belongs to the intended action repository, corresponds to the release named in the comment, and does not introduce unexpected permission or behavior changes.
Do not confuse alerts with version updates
GitHub’s secure-use guidance distinguishes two Dependabot features. Vulnerability alerts for actions are created for vulnerable semantic-version references, not for actions pinned to SHA values. Separately, Dependabot version updates can propose newer action references, including SHA changes. A pinned action can therefore receive an update pull request without receiving the same vulnerability-alert treatment that a semantic-version reference receives.
Use security advisories, maintainer announcements, code review, and your own dependency monitoring to identify urgent updates. Do not interpret the absence of a Dependabot alert as evidence that a pinned commit is safe.
Make comments useful to reviewers
Keep the intended release in a same-line comment, for example # v4.0.0. The comment does not select the code, but it tells reviewers what release was evaluated and helps Dependabot document a proposed change. If a commit is not associated with a tag, GitHub notes that Dependabot may update to the latest commit, which can differ from the latest release. Prefer a reviewed, tagged release when your policy requires release-level provenance, and inspect any untagged-commit update carefully.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Enforce full-SHA policy at the organization level
On August 15, 2025, GitHub announced a setting in allowed-actions policy that can check whether action references use a full commit SHA. When enabled, unpinned action use can fail instead of merely producing a review warning. The exact interface, policy scope, and account-plan availability are product details that can change, so verify the current settings for your organization before writing click-by-click runbooks.
Roll out enforcement in stages:
- Inventory action and reusable-workflow references across repositories.
- Pin and review the exceptions that need special handling, such as internal actions or same-repository workflow calls.
- Enable reporting or a non-blocking policy where available and fix remaining violations.
- Turn on blocking enforcement after pull requests and scheduled workflows pass with the pinned references.
- Document an exception process for emergencies, including an owner and expiration date.
Policy enforcement prevents accidental drift, but it cannot judge whether the selected commit is trustworthy. Keep source review and update approvals as separate controls.
Optional: evaluate gh-actions-lock carefully
GitHub’s gh-actions-lock extension can generate and verify a workflow dependency lockfile. The project currently labels itself a technical preview, warns that behavior may change before a stable release, and states that GitHub Enterprise Server is unsupported. Treat it as an optional aid for teams managing many repositories, not as a universal replacement for understanding and reviewing each action reference.
Before adopting it, test its generated lockfile, update behavior, CI integration, and failure modes on representative repositories. Pinning performed by a tool still requires a human to verify repository ownership, release intent, permissions, and update contents.
GitHub Enterprise Server and air-gapped considerations
A commit available on GitHub.com is not guaranteed to exist in a GitHub Enterprise Server instance. GitHub Learn warns that a commit copied from GitHub.com may be absent from an Enterprise Server actions organization. In an air-gapped or mirrored deployment, confirm that the selected action repository and commit are present on the instance before merging the workflow change.
Test the pinned workflow on the same Enterprise Server version and network boundary used in production. Check mirror synchronization, allowed-action policy, internal action repositories, and any proxy or artifact-transfer requirements. A syntactically correct SHA reference still fails if the runner cannot resolve that repository and commit locally.
Troubleshoot common pinning failures
“Unable to resolve action” or “not found”
- Confirm that the SHA has all 40 hexadecimal characters and no copied punctuation.
- Verify the owner and repository spelling and that the commit exists in that repository.
- Check whether the action is private and whether the calling repository or organization is authorized to use it.
- On Enterprise Server, verify that the commit was mirrored to the instance rather than existing only on GitHub.com.
The workflow still changes unexpectedly
- Search every workflow and reusable-workflow call for remaining branch or tag references.
- Inspect nested composite actions and called workflows; a pinned top-level action can invoke mutable dependencies.
- Check whether a script downloads a tool or executes a remote URL at runtime. SHA-pinning the action does not freeze those external downloads.
Dependabot does not open the expected pull request
- Validate that
.github/dependabot.ymluses thegithub-actionsecosystem and the correct directory. - Check repository settings, scheduling, and whether a prior update pull request is already open.
- Look at the reference’s version comment and tag association. An untagged commit may be treated differently and can lead to a latest-commit update rather than a latest-release update.
An update changes behavior or permissions
Close or revise the pull request until the new release has been reviewed. Compare the action’s source and release notes, inspect permission declarations and inputs, rerun security and integration tests, and record the approval before merging. Updating a SHA is a dependency change, not a formatting-only edit.
Recommended Free Tools
A maintainable operating procedure
- List every external action and reusable workflow used by the repository.
- For each dependency, choose the release your team intends to run and resolve its tag to a complete commit ID.
- Verify that the commit belongs to the official repository and review its source, release context, permissions, and transitive behavior.
- Replace mutable references with full SHAs and add same-line release comments.
- Run pull-request, push, scheduled, deployment, and reusable-workflow paths that exercise the changed dependencies.
- Record the selected release, SHA, review date, and owner in the pull request or dependency inventory.
- Enable Dependabot’s GitHub Actions version updates and review its proposed SHA changes.
- Monitor security advisories independently because SHA-pinned actions do not receive Dependabot vulnerability alerts in the same way as semantic-version references.
- Adopt organization policy enforcement after the repository inventory is clean, checking current product availability and plan requirements.
- Re-review emergency exceptions and remove them when the approved pinned reference is available.
This process turns an immutable reference into a sustainable dependency practice: the workflow is stable between approved changes, while updates remain visible, attributable, and testable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
