https://simonshine.dk/tags/security/Recent content in Security on Simon ShineHugoen-usSat, 08 Aug 2026 01:59:35 +0200https://simonshine.dk/articles/hashpinning/Sat, 08 Aug 2026 01:59:35 +0200https://simonshine.dk/articles/hashpinning/<p>GitHub Actions workflows usually start like this:</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-yaml" data-lang="yaml"><span style="display:flex;"><span>- <span style="color:#f92672">uses</span>: <span style="color:#ae81ff">actions/checkout@v6</span> </span></span></code></pre></div><p><code>v6</code> is a git tag that points to some commit for the release of this version of an action. There is also a <code>v6.0.1</code> tag. Every time a minor or patch version is released, e.g. <code>v6.0.2</code> or <code>v6.1.0</code>, the <code>v6</code> tag is moved to that. Being unspecific means you always get the latest version that begins with <code>v6</code>. This is a feature.</p>