Skip to content
Discussion options

You must be logged in to vote
  1. Pin workflows to a commit SHA instead of a branch

If you're referencing a reusable workflow like:

jobs:
deploy:
uses: my-org/shared-workflows/.github/workflows/deploy.yml@main

GitHub resolves the workflow from the current state of main when the workflow run starts. Using branches can lead to unexpected behavior if commits are added or if you're unsure which version was used.

A better approach is:

jobs:
deploy:
uses: my-org/shared-workflows/.github/workflows/deploy.yml@3f2c1a7

This guarantees the exact workflow version.

Replies: 1 comment

Comment options

You must be logged in to vote
0 replies
Answer selected by mrsoa1312
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Discussions GitHub Discussions is a collaborative communication feature Question Ask and answer questions about GitHub features and usage source:ui Discussions created via Community GitHub templates
2 participants