Mon, Aug 3 08:40 AM

A GitHub Actions tag is a promise, not a fact: pinning by SHA the right way

Dev.to•Sun, Aug 2, 2026, 10:58 PM•2 min read

When you write uses: actions/checkout@v4 in a GitHub Actions workflow, you are not pinning anything. You are trusting a promise. A tag is a movable pointer.

Source: [Dev.to](https://dev.to/wahib_el_khadiri_0/a-github-actions-tag-is-a-promise-not-a-fact-pinning-by-sha-the-right-way-3np)

📰 Read Full Story

This is an aggregated headline summary. For the complete report, visit the original publisher.

Continue Reading at Dev.to ↗

#tech #sha #actions #pinning #uses #pin #tag #action #comment

More Headlines

TechnologyHacker News• 6m ago

We Fixed UniFi's Slow PPPoE Performance with PPPoE Half-Bridge

1 points, 0 comments on Hacker News

TechnologyDev.to• 10m ago

Building Against Real APIs Is Nothing Like Reading the Docs

A few months ago, I started spending a lot more time working with different APIs. At first, I thought authentication would be the hardest part. Once OAuth was working and I could successfully make requests, I assumed everything else would mostly be connecting the dots.

TechnologyHacker News• 10m ago

Action Man Movie, Based on Iconic British Toy Originally Inspired by ‘G.I. Joe,’ in Development With Working Title and Hasbro

Action Man — the iconic British action figure that first launched in 1966 — is getting the movie treatment. Variety has confirmed that an Action Man film is being developed by U. K.

A GitHub Actions tag is a promise, not a fact: pinning by SHA the right way

More Headlines

We Fixed UniFi's Slow PPPoE Performance with PPPoE Half-Bridge

Building Against Real APIs Is Nothing Like Reading the Docs

Free Press Release Sites List

Bonsai: Janestreet's UI Library

Team America: Yen Police

Action Man Movie, Based on Iconic British Toy Originally Inspired by ‘G.I. Joe,’ in Development With Working Title and Hasbro