Security / Public reference

Action pinned to @main

A GitHub Actions uses value pinned to @main or @master.

What you need to supply

The workflow YAML. The check does not look up the action repository.

If it reports a finding

Medium severity. The suggested next step is to pin the action to a release tag or a full commit SHA.

What this does not prove

The check does not invent a commit SHA when the workflow only names a branch.

Uses line that this check is written to notice

- uses: actions/checkout@main

All review checks. Reading this page does not submit your infrastructure.