Good AiDeas · private-by-design developer tool
Find mutable GitHub Actions references before the next workflow run.
Paste or open one workflow. The check runs entirely in this browser and flags remote actions, reusable workflows, and container actions that are not pinned to a full commit or image digest.
Free workflow check
No file contents, file names, repository names, tokens, or workflow text are transmitted. Anonymous action counts exclude the submitted content.
| Line | Reference | Status | Reason |
|---|
What this check does—and does not do
GitHub documents full-length commit SHAs as the immutable way to reference third-party actions. This tool identifies reference format only. It does not decide whether a commit is trustworthy, resolve tags, modify workflows, inspect secrets, or certify a repository.