# Github Actions

> How to reference GitHub Actions in JabRef workflows — pin every external action to a full commit SHA with the release tag as a comment, and how to resolve that SHA. Use when adding or editing a `uses:` line under .github/workflows.

- Skill: `jabref/github-actions` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jabref/github-actions`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jabref/github-actions/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: jabref (https://skillmd.com/u/jabref)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/jabref/github-actions

---


# GitHub Actions in JabRef workflows

Pin every action from outside the repository to a **full 40-character commit SHA**, with the release tag as a trailing comment:

```yaml
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
```

Tags and branches (`@v5`, `@v1.6.3`, `@main`) are mutable: the action's code can be swapped out under us, and in a `pull_request_target` or `workflow_run` job it runs with write-capable tokens against untrusted pull request content. Dependabot updates the SHA together with its comment, so the pin stays current on its own.

Convert a tag-pinned `uses:` line to a SHA when a change touches it; do not sweep unrelated workflows in the same pull request.

Resolve a tag with:

```bash
gh api repos/<owner>/<repo>/commits/<tag> --jq .sha
```

For a sub-action such as `gittools/actions/gitversion/setup`, query the repository root (`gittools/actions`).