GitHub Actions Workflow Explainer

Q: Does this run or trigger my workflow?

No. The YAML is only parsed and analyzed as text in your browser — nothing is executed, and nothing is sent to GitHub or any server.

Q: What does "not pinned to a commit SHA" mean?

GitHub Actions references like actions/checkout@v4 point to a tag or branch, which the action's maintainer (or an attacker who compromises their account) can move to different code later. Pinning to a full 40-character commit SHA makes the reference immutable.

Q: Why is pull_request_target combined with write permissions flagged?

pull_request_target runs with access to repository secrets even for pull requests from forks. If such a workflow also checks out and runs untrusted PR code with write permissions, that's a well-documented pattern attackers can exploit to exfiltrate secrets or push changes.

Paste a workflow file (e.g. .github/workflows/ci.yml) to get a plain-language summary. Parsing happens entirely in your browser — the workflow is only read as text and is never executed or uploaded.

Workflow YAML

Summary

Name: CI

Triggers: push, pull_request

Top-level permissions: contents: read

medium

Step "actions/checkout@v4" uses "actions/checkout@v4", which is not pinned to a full commit SHA (it uses "v4"). Tags and branch names can be moved or force-pushed by the action's maintainer; pinning to a commit SHA is more tamper-resistant.

Job: build (build, runs on ubuntu-latest)

Step	Action
actions/checkout@v4	ref: v4
run step	run command
run step	run command

GitHub Actions Workflow Explainer

FAQ

Does this run or trigger my workflow?

What does "not pinned to a commit SHA" mean?

Why is pull_request_target combined with write permissions flagged?