verify-actions

Verify Actions

When to Use

• User asks for this skill's functionality

Never trust version comments in workflow files. Always verify the correct SHA against the actual upstream release before pinning or updating an action.

Why This Matters

• Comments like # v4 can be wrong — a SHA may actually point to v3 or a branch
• Version mismatches across workflows cause subtle bugs (e.g., upload-artifact v4 can't download v7 artifacts)
• Supply-chain attacks target CI — pinning a wrong SHA from main instead of a tag defeats the purpose

Agent Workflow

1. Before Changing Any Action Reference

When you encounter a uses: owner/action@SHA # vX line, verify the SHA:

For GitHub Actions:

# Look up what tag a SHA belongs to
gh api repos/{owner}/{repo}/git/ref/tags/{tag} --jq '.object.sha'

# Or list recent tags to find the right one
gh api repos/{owner}/{repo}/tags --jq '.[].name' | head -20

# Verify a specific SHA matches a tag
gh api repos/{owner}/{repo}/git/ref/tags/v4 --jq '.object.sha'

For GitLab Actions (CI/CD):

# Check the registry or project for the correct image tag
# Use the project API or container registry
glab api projects/{id}/repository/tags

Fallback — web fetch:

WebFetch: https://github.com/{owner}/{repo}/releases/tag/{tag}
Confirm the release exists and note the commit SHA.

2. Version Consistency Check

Before committing workflow changes, verify ALL action references across the workspace are version-consistent:

# Find all action references and group by action name
grep -rn 'uses:' .github/workflows/ .github/actions/ \
  | sed 's/.*uses: \([^@]*\)@.*/\1/' \
  | sort | uniq -c | sort -rn

# For each unique action, verify all SHAs match
grep -rn 'uses: actions/upload-artifact@' .github/workflows/
grep -rn 'uses: actions/checkout@' .github/workflows/
grep -rn 'uses: actions/download-artifact@' .github/workflows/

3. When Adding a New Action

1. Find the latest release tag from the upstream repo
2. Resolve the SHA for that tag using gh api
3. Pin the SHA with a version comment
4. Verify no other workflow uses a different version of the same action