GitHub Actually Fixed SHA Pinning. I Wasn’t Expecting That.

Back in March, I wrote The Comforting Lie of SHA Pinning, after spending rather too much of my Monday investigating the supply-chain compromise with Trivy and discovering something worrying about how GitHub Actions resolves dependencies.

The Comforting Lie Of SHA Pinning

Update (3 November 2026): GitHub has added workflow dependency lockfiles. I tested the original attack again and wrote up the results in GitHub Actually Fixed SHA Pinning. I Wasn’t Expecting That..