github-action/no-unpinned-uses

Disallow unpinned uses references.

📖 Rule Details

This rule reports uses references that are not pinned to a full 40-character commit SHA.

The rule checks both reusable workflow jobs.<job_id>.uses and step-level jobs.<job_id>.steps[*].uses.

Local actions (./) and Docker actions (docker://) are ignored.

name: CI

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3

correct

name: CI

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

name: CI

jobs:
  release:
    uses: owner/repo/.github/workflows/release.yml@main

incorrect

🔧 Options

Nothing.

🚀 Version

This rule was introduced in eslint-plugin-github-action v0.3.0

🔍 Implementation

• Rule source
• Test source