{
"id": "github-actions-mutable-reference",
"language": "all",
"group": "suspicious",
"listingTitle": "Pin external GitHub Actions to commit SHAs",
"title": "Pin external GitHub Actions to commit SHAs",
"mvvm": false,
"defaultSeverity": "warn",
"legacyGroup": "suspicious",
"why": "Tags and branches can move after review, allowing a workflow to execute different third-party code without a repository change.",
"suggestion": "Pin each external action or reusable workflow to a full 40-character commit SHA and retain the release tag in a comment for update tooling.",
"version": 1,
"semanticMaturity": "project",
"securityKind": "hotspot",
"taxonomy": [
"security",
"supply-chain"
],
"requirements": [
"githubActionsWorkflow"
],
"packs": [
"github-actions"
],
"implementation": "src/rules/github_actions.rs",
"languages": [],
"frameworks": [],
"languageVersions": [],
"limitations": [
"One grouped advisory is emitted per checked-in .github/workflows YAML file.",
"Local actions and docker:// references are excluded; organization-level action policies are not inspected."
]
}