github-actions-pins

GitHub Actions Pins is a maintenance repository whose purpose is to keep track of pinned metadata for GitHub Actions, so that workflows can pin immutable revisions rather than movable tags. The README describes the repository as a tracking list rather than an application, and the practical output is a machine-readable file that other projects can consume. The source of truth is a file named actions.csv. Each row holds two columns: action and ref_override. The ref_override column is left empty when no override is needed, which keeps the list readable while still allowing a specific reference to be forced for an entry. Changes to the list flow through an issue-based process. A command called gh pin can open an issue titled "Add actions to pin list" carrying the pins label. Applying that label is what approves the request. An issue workflow then validates the owner/action@ref entries submitted in the issue, and on success opens an auto-merge pull request that updates both actions.csv and pins.json. Because the pull request is set to auto-merge, approved additions are folded in without manual merging. A few rules govern how entries are interpreted. Action subpaths stay part of the pin key, so a workflow step that points at a subdirectory of an action is treated as its own key. Metadata, however, resolves against the root owner/repo rather than the subpath. Entries that already reference a full commit SHA do not need to be added to the pin list at all, since such references are immutable by construction. The generated pins.json is published and deployed to https://unfun.co/pins.json, giving consumers a stable URL to fetch the current pin data from. The project is by Daniel Morris and is made available under the MIT License; the README carries a 2026 copyright notice and links to the LICENSE.md file in the repository.