pkg.soopen package index

npm / rank 2342

Install pin-github-action with npm

Pin your GitHub Actions to specific versions automatically! Version 3.5.1 via npm; verified 2026-07-06.

Install commandSecurity notes

install

Additional install commands

Portable and language managers

npmverified · 100%
npm install -g pin-github-action

local npm package metadata

overview

Package summary

Pin your GitHub Actions to specific versions automatically!

Commands and aliases

  • pin-github-action

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for pin-github-action. Package metadata is still published here so future coverage has a stable package URL.

Install behavior

  • No npm postinstall script is recorded in package metadata.
  • No Homebrew bottle metadata was recorded.
  • Installs with 7 runtime dependencies.
  • Build metadata lists 6 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
pin-github-actioncliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-04
manager version3.5.1
manager updated2026-07-06
local dataok
upstreamnot checked
latest detectednot detected

https://github.com/mheap/pin-github-action

install metadata

Package metadata

Package keynpm:pin-github-action
Version3.5.1
Package managernpm
Package manager pagehttps://www.npmjs.com/package/pin-github-action
Homepagehttps://github.com/mheap/pin-github-action#readme
Repositoryhttps://github.com/mheap/pin-github-action
Upstream docshttps://github.com/mheap/pin-github-action#readme
LicenseMIT
Source archivehttps://registry.npmjs.org/pin-github-action/-/pin-github-action-3.5.1.tgz
Issue trackerhttps://github.com/mheap/pin-github-action/issues
Last updated2026-07-06T17:28:10.617Z
Published2026-07-06T17:28:10.617Z
Pulseupdated
Dependencies@octokit/rest, commander, debug, escape-string-regexp, fast-glob, matcher, yaml
Build dependenciescross-env, eslint, eslint-plugin-prettier, jest, nock, prettier
Bottlenot recorded
npm postinstallnot defined
Servicenone declared
Keywordsgithub actions, github, security

registry facts

Source database details

Source Databasenpm registry
Dist Tags
Latest
3.5.1
Version Count34
Maintainers
  • mheap
AuthorMichael Heap
Publishermheap
Integritysha512-scqqzMseLA3laGJtptuDhlxzb2l4zvHS6HBh2TnHPbdd3f51zcAeNoMmKhHx2Hi7XPoHlj/ArAUEhMtAEdyoBg==
Shasuma2567275acf2a471f50171a4667b0efa315574a5
Unpacked Size59,828
File Count0
Created At2020-01-14T15:53:22.775Z
Latest Published At2026-07-06T17:28:10.617Z
Modified At2026-07-06T17:28:10.742Z

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Same workflow

  • grizzlyLocal package facts share a topical domain. Shared terms: cli, debug, developer, developer-tools, github.
  • backportLocal package facts share a topical domain. Shared terms: cli, developer, developer-tools, octokit, release.
  • genversionSecurity-sensitive metadata or terminology overlaps. Shared terms: cli, commander, developer, developer-tools, release.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • cross-ecosystem install command graph
  • package relationship graph
  • package version freshness
  • package-page enrichment
  • pkg.so package database
  • pkgdb category and tag curation