---
title: "Discussion on \"Pin your GitHub Actions by commit SHA and lock workflow permissions\" | Hashnode"
description: "Discussion on \"Pin your GitHub Actions by commit SHA and lock workflow permissions\". Replace movable tags with a 40-character SHA, set GITHUB_TOKEN to read-only by default, and treat pull_request_target as a privileged event."
url: "https://hashnode.com/posts/pin-github-actions-sha-lock-workflow-permissions/6af7d3e2d56015c06c15b210"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Pin your GitHub Actions by commit SHA and lock workflow permissions](https://rokkhe.hashnode.dev/pin-github-actions-sha-lock-workflow-permissions?utm_source=hashnode&utm_medium=feed)

Replace movable tags with a 40-character SHA, set GITHUB\_TOKEN to read-only by default, and treat pull\_request\_target as a privileged event.

15h ago · 11 min read · rokkhe.hashnode.dev  
Read the article

-   [#github-actions](https://hashnode.com/tag/github-actions)
-   [#security](https://hashnode.com/tag/security)
-   [#devops](https://hashnode.com/tag/devops)
-   [#ci-cd](https://hashnode.com/tag/ci-cd)
-   [#supply-chain](https://hashnode.com/tag/supply-chain)

## Written by

[Rokkhe](https://hashnode.com/@rokkhe)

@rokkhe · Strasbourg, France

  
[View profile](https://hashnode.com/@rokkhe)

AI pentesting & AI defensive security. NVIDIA Inception member.

## Responses 2

Markdown supported · ⌘↵ to post

[OneLifeVibe](https://hashnode.com/@onelifevibe)

[4h ago](https://hashnode.com/posts/pin-github-actions-sha-lock-workflow-permissions/6af7d3e2d56015c06c15b210/comment/6af872f8dfe2c5dc935e868e)

Your point about @v6 being movable stuck with me, because it is easy to treat a major tag as if it were fixed. I also liked pairing a full 40-character SHA with a version comment, since that keeps the pin reviewable without losing the human readable release. The read-only default for GITHUB\_TOKEN is the part I would adopt first, with write scopes raised only on the job that needs them.

[Rokkhe](https://hashnode.com/@rokkhe)

[1h ago](https://hashnode.com/posts/pin-github-actions-sha-lock-workflow-permissions/6af7d3e2d56015c06c15b210/comment/6af872f8dfe2c5dc935e868e#reply-6af89a5535d31d8be59a24fd)

Thank you for such a thoughtful read, and I agree that read-only by default is the best first step. One thing that helps the SHA pinning stay practical: Dependabot or Renovate can bump the pinned SHAs and keep the version comment in sync, so pinning doesn't mean falling behind.