Lock down your GitHub Actions supply chain.
ActionLock automatically pins every GitHub Action in your workflows to a full commit SHA — and keeps it that way — so a compromised tag can never silently run in your CI again.
Detection is free. Staying fixed isn't automatic — until now.
Free scanners already tell you what's unpinned. ActionLock is the part that actually fixes it, on every repo, on every push, without anyone maintaining YAML by hand.
Automatic remediation PRs
Every mutable uses: tag gets resolved to its full commit SHA and opened as a pull request, with the human-readable version preserved as a comment.
Ongoing enforcement
A required status check blocks new unpinned Actions from ever landing again — the fix doesn't erode the moment you stop thinking about it.
Professional-grade detection
Findings are backed by the same class of analysis trusted across major open-source projects, not a homegrown rule set — so detection quality tracks the broader security community.
Zero setup
Install the GitHub App once. No YAML to write, no CI step to maintain per repo, no scripts to run and remember.
Org-wide coverage
Every repo the App is installed on gets scanned and covered consistently — no per-repo drift in what's protected.
Dependabot-style PRs
Remediation PRs follow the same comment convention you already trust from Dependabot, so review stays familiar.
How it works
From install to enforced, in four steps.
Install
Add the ActionLock GitHub App to an org or repo. Minimal permissions: contents, pull requests, workflows, metadata.
Scan
On every push and pull request, ActionLock parses your workflow files and finds every Action pinned to a mutable tag instead of a SHA.
Remediate
A pull request rewrites each reference to its resolved commit SHA, ready to review and merge.
Enforce
On paid plans, a required status check keeps future unpinned Actions from ever merging again.
Simple, flat pricing
Public repos are always free. Billed through GitHub Marketplace — no separate invoices, no custom billing to manage.
View pricing