Review the code behind an Actions dependency even when its commit is pinned

A stable dependency reference controls the selected revision; it does not review what that revision does.

Source facts

GitHub advises locking workflow dependencies with a lockfile where that approach can be adopted. For repositories that cannot use it, GitHub documents full-length commit-SHA references and checking that the selected commit belongs to the intended action repository rather than a fork. Tags can be moved or deleted. Regardless of the reference method, GitHub directs maintainers to audit the action’s source code and its handling of repository content and secrets.

Source: GitHub — Secure use reference.

Applicability

This concerns third-party GitHub Actions dependencies. It does not certify a pinned revision as harmless or establish that every transitive dependency is controlled by a single top-level SHA.

DSE recommendation

DSE recommends recording the approved action repository and revision alongside the reason for each update. Review the actual code change and permission requirements before accepting an automated dependency pull request. Prefer a reviewed dependency-locking design where supported. Keep release ownership clear so a familiar action name or marketplace badge does not substitute for examining the version that the workflow will execute. Make update review identify the executed revision and the repository it came from. Require the release owner to explain any new network access or token need visible in the diff, and preserve that decision alongside the dependency reference used by the accepted workflow.

Verification

Proposed verification: inspect a test workflow’s resolved references and compare them with the approved dependency record. Run representative build checks after an update and review logs for unintended data handling. Retain the reviewed revision, relevant diff and permission decision; do not treat a successful workflow as a complete security assessment.

Official reference

GitHub — Secure use reference. Reviewed October 20, 2026.