# Action pinned to @main

A GitHub Actions uses value pinned to @main or @master.

Area: Security

## What you need to supply

The workflow YAML. The check does not look up the action repository.

## If it reports a finding

Medium severity. The suggested next step is to pin the action to a release tag or a full commit SHA.

## What this does not prove

The check does not invent a commit SHA when the workflow only names a branch.

## Uses line that this check is written to notice

```
- uses: actions/checkout@main
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/action-pinned-to-main.