eslint-plugin-github-action

github-action/no-unpinned-uses ​

Disallow unpinned uses references.

📖 Rule Details ​

This rule reports action and reusable workflow uses references that are not pinned to a full 40-character commit SHA. Docker references must be pinned to a full SHA-256 image digest.

The rule checks both reusable workflow jobs.<job_id>.uses and step-level jobs.<job_id>.steps[*].uses.

Local actions (./) are ignored.

yaml
name: CI

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3
      - uses: docker://alpine@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
correct
yaml
name: CI

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker://alpine:latest
yaml
name: CI

jobs:
  release:
    uses: owner/repo/.github/workflows/release.yml@main
incorrect

🔧 Options ​

Nothing.

🚀 Version ​

This rule was introduced in eslint-plugin-github-action v0.3.0

🔍 Implementation ​