Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Feature Request: Improve compatibility with SHA pinning best practices

Open
#514 0 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
github-actions, typescript, vscode
Domain
ci-cd, developer-experience, devtools

Research direction

No files or tests are named. Start by tracing the extension's existing inline annotation and version-upgrade flows, then determine how SHA references map to published semver tags. Done means the agreed SHA-pinning behavior is implemented for the selected proposals and verified across annotation and upgrade interactions.

Written by the indexing model from the issue text.

Description

enhancement

Is your feature request related to a problem? Please describe.

With recent security escalations around unpinned SHAs and non-immutable release tags, the best practice in many orgs (and the best practice recommended by GitHub) is to hard-pin to SHA releases instead of semver refs.

However, this creates some issues in terms of readability and updates that otherwise would be nicely streamlined by this VS Code extension.

Describe the solution you'd like

  1. If the action is pinned to a SHA that is the same as a published semver tag, ideally that semver version would be shown inline in the extension annotation.
  2. If the user is pinned to a SHA and they click on the option to upgrade to the latest version, the extension would ideally recognize they are SHA-pinned and give them a SHA-pinned upgrade to that tag, rather than move to only pinning to the semver.
  3. If the user is pinned to a semver ref, the UI could give them an option to pin instead to the SHA ref that represents the latest from that semver. This could help users migrate to SHA-pinned references.

(Note: While both proposal 2 and proposal 3 are valuable together, they solve a similar problem. If proposal 3 is delivered, proposal 2 is less needed, and vice versa.)

Additional context

I think these features could go a long way to helping modernize GitHub Actions security, and make it more convenient for people keep their workflows safe (read: "safer") from exploits. Thanks!

Dominant language
TypeScript
Stars
661
Forks
214
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/vscode-github-actions

All issues in github/vscode-github-actions

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.