Aaron and I recently had a debate about one line in our GitHub Actions workflows.
uses: actions/checkout@v4
Aaron wanted to replace that v4 tag with a full commit hash.
His argument came straight from the GitHub docs, which say a full-length commit SHA is the only way to use an action as an immutable release.
A tag is just a pointer, and anyone with write access to the action's repository can move it.
This isn't theoretical.
In March 2025, an attacker got into the popular tj-actions/changed-files action and repointed its existing version tags at a malicious commit.
More than 23,000 repositories used that action.
Workflows referencing those tags were now running malicious code that dumped CI secrets into the build logs.
If they had been pinned to a SHA, they would not have been compromised.
I understood the argument, but I initially thought the trade-off wasn't good for our size of team. We're not pushing code 100 times a day, so I was arguing we're less vulnerable to those brief windows of supply chain attacks.
And, on top of that, I was worried about staying on older versions with their own bugs and security issues.
But, the fact is, while debating this issue, I found we were two major versions behind on actions/checkout.
So even with the floating major version, we still weren't always staying up to date anyway.
Staying up to date without giving up the pin turned out to be an interesting problem, which deserves its own tip.
One final objection I had was readability. A 40 character hash tells me nothing when I'm scanning a workflow file, and I knew I'd never go look them up.
There's a convention to put the version in a trailing comment, which addresses this:
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
I have to admit this is more informative than what we had before.
v4 never told me which v4 we were running.
Aaron won me over.
Here to help,
Joel
P.S. Supply chain attacks are one more reason to think about security at every layer. Our free Laravel security book covers the key principles to keep in mind for your own app.
