pinprick
Pin GitHub Actions to immutable SHAs, audit what they fetch at runtime, and keep the score visible in CI.
brew install starhaven-io/tap/pinprick
More options
Workflow
Make action pinning measurable, not ceremonial.
pinprick covers the part of Actions supply chain security that gets blurry after the YAML looks clean: mutable tags, runtime downloads, stale SHAs, and the drift between policy and reality.
- 01 Pin Resolve tags to full commit SHAs while preserving the human-readable tag comment.
- 02 Audit Inspect workflow scripts and action source for fetches that escape SHA pinning.
- 03 Update Move pinned actions forward when newer releases are ready to review.
- 04 Score Turn the posture into a reproducible grade that can gate CI or trend over time.
actions/checkout@v7 -> @9c091bb21b7c... # v7.0.0
audit
Find runtime fetches.
curl .../latest/tool.tar.gz
update
Keep pinned actions fresh.
pinprick update --write
score
Report a posture grade.
Grade: A (95 / 100)
Runtime audit
Pinned action, unpinned payload? That still shows up.
SHA pinning fixes the action checkout. It does not prove the action avoids mutable downloads once the job starts. pinprick follows the reachable source and flags shell, PowerShell, JavaScript, Python, and Docker fetch patterns that reintroduce drift.
Review every detection rule
high
pipe to shell
curl -fsSL ... | sh
medium
unversioned URL
wget https://example.com/tool
low
unpinned install
npm install package
CI ready
Run the CLI locally, or drop starhaven-io/pinprick-action into CI for audit plus SARIF upload.
Configure the action