Good AiDeas · private-by-design developer tool

Find mutable GitHub Actions references before the next workflow run.

Paste or open one workflow. The check runs entirely in this browser and flags remote actions, reusable workflows, and container actions that are not pinned to a full commit or image digest.

Free workflow check

No file contents, file names, repository names, tokens, or workflow text are transmitted. Anonymous action counts exclude the submitted content.

What this check does—and does not do

GitHub documents full-length commit SHAs as the immutable way to reference third-party actions. This tool identifies reference format only. It does not decide whether a commit is trustworthy, resolve tags, modify workflows, inspect secrets, or certify a repository.

GitHub security hardening guidance · Ask a scope question