← Docs

Keeping pins fresh

A SHA pin is a snapshot, not a guarantee — the tag it was resolved from can move again later (a new patch or minor release). Most repos don't have anything configured to catch that drift, so ActionLock re-checks its own pins itself: on any push to the default branch that doesn't touch workflow files, it re-resolves every pinned reference's trailing tag comment and opens a PR to re-pin any line whose tag has since moved.

You don't need to do anything for this to work — it runs automatically alongside your normal commit activity.

You can control exactly how far this re-checking is allowed to go on a given line — see opting a line out entirely or constraining it to a semver range.