# suzuki-shunsuke/pinact

pinact is a CLI to edit GitHub Workflow and Composite action files and pin versions of Actions and Reusable Workflows. pinact can also update their versions and verify version annotations.

Repository: https://github.com/suzuki-shunsuke/pinact
Canonical: https://ross.abutalabs.com/products/pinact
Language: Go
License: MIT
License Family: permissive
Topics: cli, github-actions, oss, security
Last push: 2026-09-03T00:53:08+00:00

## Health v2 (maintenance only)
Score: 96/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 100, release rhythm 95, longevity 88
- inputs: {"age_days": 1238, "days_push": 0, "days_rel": 35, "gap_med": 2, "n_releases_24m": 52}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1188, forks 39 (observed 2026-09-03T02:15:18.262949+00:00)

## What it is
pinact is a Go CLI that pins GitHub Actions and Reusable Workflows to full commit SHAs in workflow and composite action files, adding version comments for readability. It can also update pinned versions, verify version comments, enforce minimum release age, and output SARIF for reviewdog-based reviews.

## Use cases
- pin github actions to commit shas in workflow files
- update pinned action versions with a cooldown period
- verify version comments on sha-pinned actions in ci
- check that all actions in workflows are pinned without editing files
- pin actions referenced in readme code examples
- generate sarif findings for unpinned actions to review with reviewdog

## When to choose
- you want to harden GitHub Actions workflows against supply-chain attacks by pinning actions to SHAs
- you need to keep pinned action versions up to date while enforcing a minimum release age
- you want CI validation that actions are pinned and version comments are correct
- you use GitHub Enterprise Server or need offline checking without the GitHub API

## When to avoid
- you don't use GitHub Actions or reusable workflows
- you need a general-purpose YAML formatter or linter rather than action pinning
- you want automatic merging of action version updates rather than file edits

## Facets
- artifact type: cli-tool
- maturity: active
- function: cli, security, developer-tools, ci-cd, version-control, code-review, configuration-management, yaml
- domain: developer-tools, security, version-control
- platform: cli, cross-platform
- tags: github-actions, supply-chain-security, pin-actions, sha-pinning, workflow-files, sarif, reviewdog, github-enterprise, version-comments, reusable-workflows, devops, automation, command-line

## Member repositories
- suzuki-shunsuke/pinact (main) score 96

## Provenance
- Observed fields: from GitHub, fetched 2026-09-03T02:15:18.262949+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:26:08.900505+00:00, confidence not recorded.
  - readme: https://github.com/suzuki-shunsuke/pinact (fetched 2026-09-03T02:15:18.262949+00:00, sha fdd32ff525ce)
- Data as of 2026-08-30T08:39:29.467469+00:00.