A gh CLI extension that generates and verifies the GitHub Actions dependency lockfile, pinning every action your workflows use to an exact commit.
-
Updated
Jul 31, 2026 - Go
#
dependency-pinning
Here are 7 public repositories matching this topic...
Pin your GitHub Actions. Prick holes in their supply chain security.
rust cli security cicd appsec software-supply-chain devsecops github-actions rust-cli slsa supply-chain-security dependency-pinning sha-pinning
-
Updated
Jul 31, 2026 - Rust
Tooling to manage the `pyodide-lock.json` file
-
Updated
Jul 24, 2026 - Python
The authoritative definition of the GitHub Actions dependency lockfile format, plus a Go parser for auditing and verifying the action pins in use across a repo's workflows.
-
Updated
Jul 31, 2026 - Go
Scripts to pin poetry and pipenv dependencies
python poetry pipfile dependencies dependency pinning pipenv pyproject dependency-hell dependency-pinning
-
Updated
Jul 27, 2022 - Python
Pin workflow dependency versions to full-length hashes.
-
Updated
Jul 21, 2026 - C#
Audit your GitHub Actions supply chain security with pinprick
security cicd sarif devsecops github-actions github-action supply-chain-security dependency-pinning sha-pinning
-
Updated
Jul 31, 2026 - Shell
Improve this page
Add a description, image, and links to the dependency-pinning topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the dependency-pinning topic, visit your repo's landing page and select "manage topics."