actions-pinning

Pins every uses: reference in GitHub Actions workflows, composite actions, and reusable workflows to a commit SHA, verifies each SHA belongs to the claimed action repository, and keeps the pins current with Dependabot.

This skill covers supply-chain pinning only. /oss-hygiene covers Token-Permissions and Dangerous-Workflow hardening for the same workflow files; /ci-optimize covers wall-clock speed. Run those separately.

Protocol

1. Inventory

Run the bundled scanner against every workflow and composite/reusable workflow file: