All rules

P015 UnpinnedActions

Applies to
Pull requests, through the GitHub App
Severity
Warning (fails the check under fail-on-warnings)
Summary
A change uses a GitHub Action without pinning it to a commit.
Flags
Added uses: lines in .github/workflows/, .github/actions/ and action.yml files whose reference is not a 40-character commit SHA. Local actions (./) and docker:// images are not checked. Comment lines are skipped.
Known limits
Only added uses: lines are checked. Actions already on the default branch when the App is installed are not flagged until a pull request edits their line.

Before

- uses: actions/checkout@v7

After

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

Fix