# Pin third-party CI actions to commit hashes

Floating tags on third-party pipeline actions replaced with commit hashes, so a moved tag cannot change what runs.

Category: Dependency and runtime upgrades
Source: https://letsship.ai/use-cases/pin-ci-actions-to-commit-hashes
Published: 2026-08-25

## Goal

Replace floating version tags on third-party CI actions with pinned commit hashes.

## Acceptance criteria

- Every third-party action is referenced by a full commit hash
- The version each hash corresponds to is recorded in a comment beside it
- The pipeline runs green after the change
- First-party actions inside this organisation are left as they are

## What lands as proof

The workflow diff showing hashes with their version comments, and a green run on the pinned set.

## Prompt

Copy this to an agent to open the ticket:

```text
Create a Linear issue in my team and assign it to the SHIP agent.

Title: Pin third-party CI actions to commit SHAs

Description: Replace floating version tags on third-party CI actions with pinned commit hashes.

Acceptance criteria:
- Every third-party action is referenced by a full commit hash
- The version each hash corresponds to is recorded in a comment beside it
- The pipeline runs green after the change
- First-party actions inside this organisation are left as they are

Before you create the issue, list the third-party actions used in this repository's workflows so the description names them. Editing pipeline files stops the run for a human to approve, which is expected here.
```

## Questions

### What does the agent actually change?

The ticket is scoped to one outcome: replace floating version tags on third-party CI actions with pinned commit hashes. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.

### How do I know the work is done?

The pull request carries the evidence, not only the diff. Here that means pipeline edits pause for approval, timings unchanged, so a reviewer can confirm the result without reproducing the work locally.

### How much oversight does this need?

The run stops for the plan, and the review bar is raised afterwards so that smaller suggestions block the merge too, not only serious findings.