pinact

CLI that pins GitHub Actions and reusable workflows to commit SHAs, with version verification.

Desktopfreeglobal

pinact is a command-line tool that edits GitHub workflow and composite action files to pin Actions and reusable workflows to immutable commit SHAs, reducing the supply-chain risk from tags that can be moved. It automates pinning, verification and updates (including offline checks, minimum-release-age enforcement and SARIF output) and is intended for engineering and security teams and open-source maintainers using GitHub Actions; it’s open-source under the MIT license and supports GitHub Enterprise Server.

Website

Full match profile

Behind the summary, Matchbox keeps a richer profile of pinact - the signals our matcher actually reads to decide when to surface it. It stays private; claim the listing to see and control it.

Problem & pain-point mapping
Who we surface it to (audience fit)
What it's a strong alternative to
Trust & credibility signals

Claim pinact to unlock →

Try Matchbox with your own problem

Describe what is not working - we’ll show you whether pinact (or something else) actually fits.

Try a problem