Automatically pin mutable tags to immutable SHA-1 hashes to prevent supply chain attacks.
In organic chemistry, the Pinner reaction involves the acid-catalyzed conversion of a reactive nitrile into a highly stable salt.
"Just as the reaction transforms a volatile compound into a stable, fixed salt, this CLI transforms floating tags into secure, immutable commit SHAs."
$ pinner pin
Searching for workflows in .github/workflows/...
actions/checkout@v4 -> actions/checkout@8f4b7f84... # v4
dtolnay/rust-toolchain@master -> dtolnay/rust-toolchain@e97e2d8c... # master
Successfully pinned 12 actions across 3 files!
$ pinner verify
Verifying action pinning...
All actions are correctly pinned! ✅
Built with Rust and `tree-sitter` for maximum speed and precision. Scan hundreds of actions in milliseconds.
Protects your CI/CD against tag-moving attacks. Native support for `verify` mode in your CI pipelines.
Configurable via `.pinner.toml`. Supports GitHub Enterprise with custom API URLs and tokens.
curl -sSL https://raw.githubusercontent.com/ffalcinelli/pinner/main/install.sh | sh
One-line installation for instant workflow security.