TLDR Tech / InfoSec
Speedrunning SHA pinning for GitHub Actions org-wide
Spurred by the 2025 tj-actions/changed-files supply chain compromise, a Semgrep engineer successfully enforced full-length SHA pinning for GitHub Actions across 350 repositories. The deployment utilized native GitHub enforcement settings alongside tools like pinact and Renovate to automatically convert tags and eliminate unpinned reference classes at scale. Security teams adopting this playbook should auto-enroll new repositories via webhooks, monitor for pipeline failures, and update developer guidance files before strictly enforcing the restriction across their organization.
Read the full story