How to verify a pinned GitHub Action SHA yourself

A pin is only as good as the SHA in it. Before you merge a pull request that pins actions, you can check each SHA against the tag in its comment in a few seconds.

With git

git ls-remote asks the repository directly. For annotated tags, the line ending in ^{} is the commit the tag points at; that is the SHA the pin should contain.

git ls-remote https://github.com/actions/setup-node "refs/tags/v4*"

With the GitHub API

GET /repos/{owner}/{repo}/git/ref/tags/{tag} returns the object the tag points at. If its type is tag (an annotated tag), follow it with GET /repos/{owner}/{repo}/git/tags/{sha} to reach the commit.

curl -s https://api.github.com/repos/actions/setup-node/git/ref/tags/v4

Remember it is a snapshot

The SHA is correct for the moment you looked. The tag can move later; that is the point of pinning. Re-resolve when you deliberately update, and let Dependabot or Renovate propose the bumps.

What Anchorflow checks

Every pin Anchorflow makes comes with its receipt: each API endpoint it called in order, the tag-object and commit SHAs along the way, and the git ls-remote line to reproduce it. Copy the line, run it, and compare.

Check your workflow