gha-hashpinner 0.0.1

Update GitHub Actions configurations to use hashpins, instead of mutable pins, in a Dependabot-compatible way

gha-hashpinner

Finds mutable pins in GitHub Actions config and replaces them with immutable commit SHAs.

This is a security best practice that protects against supply chain attacks.

The immutable hashpins generated by this tool include version comments which are Dependabot-compatible.

E.g.:

❌ Mutable pins are a bad practice (you might get pwned!):

jobs:
  my-job:
    steps:
      - name: "Checkout"
        uses: "actions/checkout@v4"

✅ This tool will convert them to immutable pins:

jobs:
  my-job:
    steps:
      - name: "Checkout"
        uses: "actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5"  # v4

Install

uv tool install gha-hashpinner

Usage

From a GitHub repository containing GitHub Actions workflows in .github/workflows:

gha-hashpinner .

Or, update a specific workflow file:

gha-hashpinner .github/workflows/my-workflow.yml

Alternatives

• https://github.com/azat-io/actions-up: NPM package
• https://github.com/Skipants/update-action-pins: Go package

Why?

I deeply distrust the NPM ecosystem. The Go package above is not user-friendly to install.

I wanted something I could install with uv tool install.

LLMs plus a dash of review and engineering judgement make it fast and easy to build tools like this.