The Comforting Lie Of SHA Pinning

SHA pinning in GitHub Actions is widely recommended as a security best practice, but it has a critical flaw: GitHub does not validate that a commit SHA belongs to the referenced repository. Because forks share a Git object graph, an attacker can submit a PR that replaces a pinned action's SHA with one from an attacker-controlled fork while keeping the owner/repo reference unchanged. Reviewers see only a SHA bump and assume it's a safe version update. The post argues that SHA pinning is security theater — it trades mutable-but-scoped tags for immutable-but-unscoped SHAs, which is arguably worse. The recommendation is to introduce provenance checks that verify a SHA actually originates from the expected repository, and for GitHub to enforce tag immutability by default.