# Pin Workflows > Audits all .github/workflows/ action references, upgrades any that are behind the latest release, and pins every tag to its exact SHA commit hash for supply chain security. Use when this capability is needed. - Skill: `tomevault-io/pin-workflows` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/pin-workflows` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/pin-workflows/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/pin-workflows --- For every `uses:` line in every file under `.github/workflows/`: 1. If the action reference uses a floating tag (e.g. `@v3`, `@v4`, `@v6`) rather than a full SHA commit hash, it must be pinned. 2. For each action that needs pinning: a. Use `gh api repos/{owner}/{repo}/releases/latest` to find the latest release tag. b. If the currently used major version is behind the latest, upgrade to the latest release tag. c. Use `gh api repos/{owner}/{repo}/git/ref/tags/{tag}` to resolve the tag to its commit SHA. d. Replace the floating tag reference with the commit SHA and append the version as a comment, e.g. `uses: actions/checkout@abc1234... # v6.0.2`. 3. Leave any reference that is already pinned to a full SHA alone unless its version is outdated — in that case resolve the latest tag's SHA and update both the SHA and the comment. 4. After all files are processed, print a summary table of every change made (action, old ref, new ref). --- > Source: [dbrennand/home-ops](https://github.com/dbrennand/home-ops) — distributed by [TomeVault](https://tomevault.io).