suzuki-shunsuke/pinact

Health v2 · maintenance only

Adoption not part of the score

1188 stars · 39 forks observed · 2026-09-03

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

pinact is a Go CLI that pins GitHub Actions and Reusable Workflows to full commit SHAs in workflow and composite action files, adding version comments for readability. It can also update pinned versions, verify version comments, enforce minimum release age, and output SARIF for reviewdog-based reviews.

Use cases

• pin github actions to commit shas in workflow files
• update pinned action versions with a cooldown period
• verify version comments on sha-pinned actions in ci
• check that all actions in workflows are pinned without editing files
• pin actions referenced in readme code examples
• generate sarif findings for unpinned actions to review with reviewdog

When to choose

• you want to harden GitHub Actions workflows against supply-chain attacks by pinning actions to SHAs
• you need to keep pinned action versions up to date while enforcing a minimum release age
• you want CI validation that actions are pinned and version comments are correct
• you use GitHub Enterprise Server or need offline checking without the GitHub API

When to avoid

• you don't use GitHub Actions or reusable workflows
• you need a general-purpose YAML formatter or linter rather than action pinning
• you want automatic merging of action version updates rather than file edits

Facets

cli-tool · maturity active

cli security developer-tools ci-cd version-control code-review configuration-management yaml developer-tools security version-control cli cross-platform github-actions supply-chain-security pin-actions sha-pinning workflow-files sarif reviewdog github-enterprise version-comments reusable-workflows devops automation command-line

Member repositories

For agents

markdown · JSON · MCP: product_card(name="suzuki-shunsuke/pinact")