⚙️ [Maintenance]: GitHub Action pins can be synchronized

[Marius Storhaug (MariusStorhaug)]

Repositories can now synchronize GitHub Action SHA pins with the latest stable releases through a reusable, dependency-free PowerShell utility. The GitHub Actions standard explains how it complements Dependabot for audits and deliberate manual synchronization.

New: Action-pin synchronization

Run the utility against any repository to resolve each supported action release tag to its immutable commit SHA, including composite-action subpaths and annotated tags. Use -WhatIf to review proposed pin and release-comment changes without writing files.

---

Technical details

• Update-GitHubActionPin.ps1 scans .github YAML recursively, preserves UTF-8 BOM and line endings, honors ShouldProcess, avoids rewriting current pins, and uses GITHUB_TOKEN or GH_TOKEN when available.
• Focused Pester fixtures cover annotated tags, composite subpaths, omitted comments, local and Docker references, BOM/CRLF preservation, -WhatIf, no-op pins, and unresolved releases.
• Implementation plan progress: updater, focused tests, live -WhatIf API smoke test, and GitHub Actions standard guidance are complete.
• Standards and framework alignment:

Changed surface	Standards checked	Framework docs checked	Result
.github/scripts/**	PowerShell, GitHub Actions, Security	None (no framework-specific docs)	Aligned
tests/**	Testing, PowerShell Testing	None (no framework-specific docs)	Aligned
src/docs/Coding-Standards/GitHub-Actions.md	GitHub Actions, Markdown, Natural Language	None (no framework-specific docs)	Aligned

Relevant issues (or links)

Related work

• References Bump the github-actions group with 2 updates PSModule/Process-PSModule#511