DX005: Action not pinned to a commit SHA

Severity: medium · Category: security · Applies to: github_actions

Why it matters

Tags and branches can be moved. If an action's repository is compromised, every workflow using a mutable reference runs the attacker's code.

How to fix

Pin the action to a full commit SHA and keep a version comment.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - DX005

Or skip one line with a comment on that line or the line above:

devshield-ignore: DX005