Speedrunrunning SHA pinning for GitHub Actions org-wide

Following the 2025 tj-actions/changed-files compromise, in which attackers redirected tagged releases to malicious commits, the author describes enabling GitHub’s full 40-character SHA pinning requirement across roughly 350 repositories to prevent workflows from executing mutable action tags or branches. The requirement applies not only to directly referenced actions but also to actions used transitively within composite actions and reusable workflows, making rollout more complex than simply converting tags such as `@v4` to commit SHAs. The effort began with small-scale testing that exposed issues involving internal actions referenced by branches and unpinned dependencies, then expanded through scripts and Semgrep Agentic Workflows to inventory repositories, generate remediation pull requests, and monitor failures. Pinact was used to convert tagged actions while Renovate was adopted to keep SHA-pinned internal and third-party actions updated with configured cooldowns and controlled major-version upgrades. The author also discusses GitHub limitations, including the lack of an evaluation mode, aggregate failure reporting, or exceptions under organization-wide enforcement, and notes complications involving reusable workflow behavior, CODEOWNERS, auto-merge, and abandoned third-party actions. The recommended rollout is to communicate the change, automatically protect new and inactive repositories, establish an update strategy, test and monitor enforcement repository by repository, resolve direct and transitive dependencies, and only then enable the setting organization-wide with monitoring and repository-level rollback options available.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.