Lock your GitHub Actions (pin actions to SHAs)
Spotted 2026-11-12 22:06 (UTC+8) · original event 2026-11-12 · sources: Hacker News · spreading on 1 platformHeat score
Rank score: 7540% — where it sits on the charts
Discussion score: 8040% — how much people are talking about it
Cross-platform score: 3020% — how many platforms it spread to
Composite heat score:48.0rank × 0.4 + discussion × 0.4 + cross-platform × 0.2 — includes a -20-point cooling decay (peak passed, attention fading).
Why it matters
Unpinned GitHub Actions can be swapped under you; supply-chain attacks ride on floating tags.The angle
The 2-minute fix: pin to SHAs, and what breaks if you do notSuggested format: Short video · for DevelopersEvidence chain
• HN #19, 295 pts, 59 comments (2026-11-12)• guide hugovk.dev• out of HN top 30 at 00:07 HKT 2026-11-13, -20 cooling