About
This skill implements security best practices for GitHub Actions by pinning third-party actions to specific commit SHAs instead of mutable tags. Using the specialized 'pinact' utility, it identifies unpinned actions across all workflow files, provides a detailed diff for verification, and performs bulk conversions while preserving version readability through comments. This automation hardens your CI/CD pipeline against supply chain attacks and ensures consistent, reproducible builds without the manual effort of looking up commit hashes.
