GitHub Actions Workflow Explainer

Q: Does this run or trigger my workflow?

No. The YAML is only parsed and analyzed as text in your browser — nothing is executed, and nothing is sent to GitHub or any server.

Q: What does "not pinned to a commit SHA" mean?

GitHub Actions references like actions/checkout@v4 point to a tag or branch, which the action's maintainer (or an attacker who compromises their account) can move to different code later. Pinning to a full 40-character commit SHA makes the reference immutable.

Q: Why is pull_request_target combined with write permissions flagged?

pull_request_target runs with access to repository secrets even for pull requests from forks. If such a workflow also checks out and runs untrusted PR code with write permissions, that's a well-documented pattern attackers can exploit to exfiltrate secrets or push changes.

Paste a workflow file (e.g. .github/workflows/ci.yml) to get a plain-language summary. Parsing happens entirely in your browser — the workflow is only read as text and is never executed or uploaded.

Workflow YAML

Summary

Name: CI

Triggers: push, pull_request

Top-level permissions: contents: read

medium

Step "actions/checkout@v4" uses "actions/checkout@v4", which is not pinned to a full commit SHA (it uses "v4"). Tags and branch names can be moved or force-pushed by the action's maintainer; pinning to a commit SHA is more tamper-resistant.

Job: build (build, runs on ubuntu-latest)

Step	Action
actions/checkout@v4	ref: v4
run step	run command
run step	run command

GitHub Actions review examples

Read triggers, token permissions, and third-party action references together before trusting a workflow.

Least-privilege token

permissions:
  contents: read

The workflow receives read-only repository content access unless a job narrows or changes it.

Immutable action reference

uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

A full commit SHA cannot move like a tag or branch.

Common mistakes

Leaving write-all permissions at workflow scope.
Running untrusted pull-request code under pull_request_target.
Treating a major-version tag as an immutable dependency.

GitHub Actions permissions and SHA pinning Browse DevOps configuration tools

Examples and guidance reviewed July 19, 2026.

GitHub Actions Workflow Explainer

GitHub Actions review examples

Common mistakes

FAQ

Does this run or trigger my workflow?

What does "not pinned to a commit SHA" mean?

Why is pull_request_target combined with write permissions flagged?