← Docs

The pin comment format

Each rewrite resolves the tag to its current full commit SHA and keeps the original tag as a trailing comment, in a widely recognized format:

- uses: actions/checkout@v4

becomes:

- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

Keeping the tag visible means the diff stays readable in review, and if you also run other automated dependency-update tooling, it can still recognize and bump the pin later — the two don't conflict.