---
title: "Comment by OneLifeVibe on \"Pin your GitHub Actions by commit SHA and lock workflow permissions\" | Hashnode"
description: "Your point about @v6 being movable stuck with me, because it is easy to treat a major tag as if it were fixed. I also liked pairing a full 40-character SHA with"
url: "https://hashnode.com/posts/pin-github-actions-sha-lock-workflow-permissions/6af7d3e2d56015c06c15b210/comment/6af872f8dfe2c5dc935e868e"
---

[Discussion](https://hashnode.com/posts/pin-github-actions-sha-lock-workflow-permissions/6af7d3e2d56015c06c15b210)

Comment [Pin your GitHub Actions by commit SHA and lock workflow permissions](https://hashnode.com/posts/pin-github-actions-sha-lock-workflow-permissions/6af7d3e2d56015c06c15b210)

[OneLifeVibe](https://hashnode.com/@onelifevibe)

[4h ago](https://hashnode.com/posts/pin-github-actions-sha-lock-workflow-permissions/6af7d3e2d56015c06c15b210/comment/6af872f8dfe2c5dc935e868e)

Your point about @v6 being movable stuck with me, because it is easy to treat a major tag as if it were fixed. I also liked pairing a full 40-character SHA with a version comment, since that keeps the pin reviewable without losing the human readable release. The read-only default for GITHUB\_TOKEN is the part I would adopt first, with write scopes raised only on the job that needs them.

[Rokkhe](https://hashnode.com/@rokkhe)

[1h ago](https://hashnode.com/posts/pin-github-actions-sha-lock-workflow-permissions/6af7d3e2d56015c06c15b210/comment/6af872f8dfe2c5dc935e868e#reply-6af89a5535d31d8be59a24fd)

Thank you for such a thoughtful read, and I agree that read-only by default is the best first step. One thing that helps the SHA pinning stay practical: Dependabot or Renovate can bump the pinned SHAs and keep the version comment in sync, so pinning doesn't mean falling behind.