Avoid floating references for critical workflow dependencies.
Section: Reduce pipeline risk
Pin actions to a version or commit
yaml
yaml
- uses: actions/checkout@v4Explanation
Pinning reduces surprise breakage. For higher assurance, pin to a full commit SHA after validation.
Learn the surrounding workflow
Compare similar commands or jump into common fixes when this command is part of a bigger troubleshooting path.
Related commands
Same sheet · prioritizing Reduce pipeline risk
Be careful with untrusted pull requests
Avoid exposing secrets to code from forks.
Require approval for production release
Add environment rules or manual gates before prod deploys.
Use least-privilege permissions in GitHub Actions
Explicitly scope the token for each workflow or job.
Use OIDC instead of long-lived cloud keys
Exchange a short-lived identity token for cloud credentials.
Protect production variables in GitLab
Restrict sensitive variables to protected branches or tags.