Metadata-Version: 2.4
Name: gha-hashpinner
Version: 0.0.1
Summary: Update GitHub Actions configurations to use hashpins, instead of mutable pins, in a Dependabot-compatible way
Project-URL: Repository, https://github.com/mfisher87/gha-hashpinner.git
Project-URL: Homepage, https://github.com/mfisher87/gha-hashpinner
Project-URL: Issues, https://github.com/mfisher87/gha-hashpinner/issues
License-File: LICENSE
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: BSD License
Classifier: Programming Language :: Python
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Security
Classifier: Topic :: Utilities
Requires-Python: >=3.12
Requires-Dist: pygithub>=2.9.0
Requires-Dist: pyyaml>=6.0.3
Requires-Dist: rich>=14.3.3
Requires-Dist: typer>=0.24.1
Description-Content-Type: text/markdown

# `gha-hashpinner`

Finds mutable pins in GitHub Actions config and replaces them with immutable commit SHAs.

This is a security best practice that protects against supply chain attacks.

The immutable hashpins generated by this tool include version comments which are
**Dependabot-compatible**.

E.g.:

❌ Mutable pins are a bad practice (you might get pwned!):

```yaml
jobs:
  my-job:
    steps:
      - name: "Checkout"
        uses: "actions/checkout@v4"
```

✅ This tool will convert them to immutable pins:

```yaml
jobs:
  my-job:
    steps:
      - name: "Checkout"
        uses: "actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5"  # v4
```


## Install

```bash
uv tool install gha-hashpinner
```


## Usage

From a GitHub repository containing GitHub Actions workflows in `.github/workflows`:

```bash
gha-hashpinner .
```

Or, update a specific workflow file:

```bash
gha-hashpinner .github/workflows/my-workflow.yml
```


## Alternatives

* <https://github.com/azat-io/actions-up>: NPM package
* <https://github.com/Skipants/update-action-pins>: Go package


### Why?

I deeply distrust the NPM ecosystem.
The Go package above is not user-friendly to install.

I wanted something I could install with `uv tool install`.

LLMs plus a dash of review and engineering judgement make it fast and easy to build
tools like this.
