---
name: "tech-pin-github-actions"
title: "Pin GitHub Actions"
description: "Pin actions to version or commit SHA; moving major tags can be force-pushed"
type: "tech"
category: "ci"
tags: ["tech", "ci", "security"]
related: ["[[tech-trivy-two-phase]]", "[[feedback-public-kb-only]]"]
---
Actions run with repo secrets. Prefer `@vX.Y.Z` or commit SHA pins; avoid floating `@v0`.

Incident reference: trivy-action tags force-pushed (2026). Related: [[tech-trivy-two-phase]], [[feedback-public-kb-only]].