pinact: vanhemmat versiot ja versiohistoria

#1813 Publish packslip.sigstore.json

⚠️ Security
#1792 Update Go to v1.27.3
This release is built with Go 1.27.3, which fixes CVE-2026-111943 in crypto/x509. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. Verify filters out chains containing those intermediates. The Go team highly recommends upgrading immediately.
pinact relies on crypto/x509 to verify the TLS certificate of GitHub when it calls the GitHub API, with your access token if one is set, to resolve the commit SHAs that workflows are pinned to. We recommend upgrading.
ref.
- https://go.dev/doc/devel/release#go1.27.3
- https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
This release also includes Go 1.27.2 (#1764), which has security fixes to the go command and the crypto/tls, html/template, net/http, net/textproto, and os packages.
- https://go.dev/doc/devel/release#go1.27.2

Others
#1766 ci: Update GitHub Actions runner to ubuntu-26.04
#1767 ci: Use download-go-module-action
#1768 ci: Share Go modules between integration test and go-test-full-workflow
#1774 ci: Use the reusable workflow of go-autofix-action
#1782 ci: Replace go-test-full-workflow with go-test-workflow and test-workflow

Dependency updates
#1764 #1792 Update Go to v1.27.3
#1730 #1789 Update github.com/google/go-github to v93
#1739 Update github.com/suzuki-shunsuke/cobra-util to v0.0.5
#1723 Update github.com/sourcegraph/go-diff to v0.9.0

Upgrade Guide
⚠️ Breaking Changes
#1704 The CLI is built with spf13/cobra instead of urfave/cli
The commands, the flags, and their behavior are unchanged, but a long flag must now be written with two dashes.
# v4
pinact run -check
pinact run -fix=false -no-api
pinact run -diff-file diff.txt
# v5
pinact run --check
pinact run --fix=false --no-api
pinact run --diff-file diff.txt
urfave/cli accepted a long flag with a single dash. cobra's flag parser does not: a single dash introduces short flags, and -c is the short flag of --config, so -check would otherwise be read as --config=heck and pinact would silently look for a configuration file named heck. To prevent that, pinact rejects a single-dash long flag with an error naming the form to use:
$ pinact run -check
unknown flag: -check. Long flags need two dashes since pinact v5: --check
Short flags are unchanged and can still be written with a single dash:
pinact run -u -m 7
pinact run -i "^actions/.*$" -e "^actions/checkout$"
pinact init -g
pinact -c pinact.yaml run
--verify and --sep also keep working, as aliases of --verify-comment and --separator.
The migration fixes two urfave/cli bugs that pinact ran into:
- A workflow file named help could not be passed to pinact run: the argument was taken as a request for the help of run.
- Pressing TAB after a -- ran the command instead of completing it (urfave/cli#1993). Since pinact run fixes files by default, a TAB pressed while typing a pinact run -- command line rewrote the workflow files then and there. cobra completes through a separate hidden command that never reaches the action.
cobra also brings its own completion command, so pinact completion bash|zsh|fish|powershell generates a completion script.
#1704 The Go module path is now github.com/suzuki-shunsuke/pinact/v5
go install github.com/suzuki-shunsuke/pinact/v5/cmd/pinact@latest
This affects anyone importing pinact as a library, and go install. Installing the CLI from a release asset or via aqua is unaffected.
#1708 Documents under docs/ are renamed with underscores
docs/why-pinact-not-pin.md becomes docs/why_pinact_not_pin.md, so a link to the old path from outside this repository breaks. The README is also split into documents, so links to the section anchors that moved, such as #update-actions--update, now land on the README rather than on the section.

Features
#1708 pinact docs: serve the documentation to coding agents
#1705 pinact json-schema: output the JSON Schema of the configuration file

pinact docs
pinact docs lists the documents embedded in the binary and outputs them, so that a coding agent answering a question about pinact reads the documentation of the version that is actually installed rather than the source code or whichever version of the website it lands on.
$ pinact docs list # the name and the description of every document, as JSON
$ pinact docs show config # one document
$ pinact docs show codes/005
The README is split into documents so that the binary ships them: --update, --min-age, --no-api, SARIF, --diff-file, and the access token used to exist only in the README, which the binary doesn't ship. pinact docs list now lists 21 documents instead of 12, and the README goes from 431 lines to 169, keeping what someone reads to decide whether to use pinact.
The command is only useful to an agent that knows it exists, so pinact --help says so, every error pinact reports carries the hint as the help attribute, and pinact -v logs it:
$ pinact -v
pinact version v5.0.0
INF If you are a coding agent, run `pinact docs list` to list the documentation and `pinact docs show <name>` to read it before answering questions about pinact or troubleshooting its errors.
The hint goes to stderr as a log rather than to stdout, so it doesn't break a script that parses the version, and it is logged at the info level, so --log-level warn silences it. The routine outcomes of pinact run are unaffected: the exit codes 1, 2, and 3 are unchanged, and nothing is logged for them.
An ag

Dependency Updates
#1634 Update Go to v1.26.5
#1659 Update module github.com/suzuki-shunsuke/ghtkn-go-sdk to v0.5.0
#1622 Update module github.com/urfave/cli/v3 to v3.10.1
#1633 Update module github.com/google/go-github/v88 to v89
#1646 Update dependency sigstore/cosign to v3.1.2
#1653 Update dependency anchore/syft to v1.49.0
#1657 Update dependency goreleaser/goreleaser to v2.17.1

Features
#1578 Update ghtkn-go-sdk to v0.3.0 for backend and disable device flow support

⚠️ Breaking Changes
#1540 Removed the -review option
Output SARIF and pass it to reviewdog. This has been announced previously.
pinact run -format sarif |
reviewdog -f sarif -name pinact -reporter github-pr-review
#1540 Always output diff
Even if you specify -diff=false, it is ignored.
#1540 -diff and -check are now aliases for -fix=false
This simplifies the logic, making it easier to understand and less prone to bugs.
#1540 -verify is now an alias for --verify-comment
-verify was unclear about what was being verified, so it has been renamed for clarity.
However, -verify is kept as-is to maintain backward compatibility.
#1458 #1558 Version comments are now required @ManuelLerchnerQC
For SHAs without a version comment, pinact automatically adds a version comment (validation error if -fix=false).
$ pinact run test.yaml
test.yaml:1
- - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Specifying a version comment makes it easier to see which version is being used, and makes it easier for tools like Renovate and Dependabot to update.
It also has security implications.
For GitHub Actions versions, you can also specify the SHA of a commit in a fork.
This means it could point to a malicious commit in a fork.
If you specify only the SHA without a version comment, you cannot tell whether it is the SHA of a commit in a fork.
By requiring version comments, you can verify that the version comment matches the SHA using the --verify-comment option.
Even if a fake version comment is added to a fork's SHA, it can be detected by --verify-comment.
An attacker could also create a tag pointing to a fork's SHA, but creating a tag requires write permission, which raises the bar for attacks, so this can be said to improve security.
Of course, this is only meaningful if you verify with --verify-comment, so it is recommended to run pinact with --verify-comment in CI.

Features
#1540 -no-api: support for offline validation
#1540 You can now check whether the version being used satisfies min age, not just newer versions
#1540 More flexible min age support via rules
#1540 #1542 #1543 Support for a global configuration file
#1435 Automatic correction of version comments via -verify-comment @ManuelLerchnerQC
#1547 #1552 #1557 #1562 -diff-file: limit pinact's targets to only the changed lines

-no-api: support for offline validation
If you just want to check whether something is pinned, you don't really need to use the GitHub API, but previously the GitHub API was called.
With the -no-api option, you can validate without calling the GitHub API.
However, since API calls are currently essential for fixing code (this may change in the future if caching is supported), you need to specify either -fix=false or -format sarif.
Implicitly treating it as -fix=false could cause behavior to change and become a breaking change when caching is supported, so it must currently be specified explicitly.

You can now check whether the version being used satisfies min age, not just newer versions
For example, you can run it in CI against modified lines to check whether any dangerous versions that do not satisfy min age are being used.
This is not checked by default, but is checked when you run pinact run --verify-min-age or pinact run -min-age <min age>.

More flexible min age support via rules
min age can now be configured in the configuration file.
Additionally, by using rules, you can apply settings such as min age to specific actions.
min_age:
value: 7 # default setting
rules:
# Allow latest for suzuki-shunsuke's actions
- ignore: true
conditions:
- expr: |
ActionRepoOwner == "suzuki-shunsuke" && ActionVersion == "latest"
# Set min age to 0 for actions/checkout
- min_age: 0
conditions:
- expr: |
ActionRepoFullName == "actions/checkout"
For rules, conditions are evaluated per rule, and the settings are applied if matched.
You can write multiple conditions, and the settings are applied

🐛 Bug Fixes
#1535 pin uses lines with multiple spaces after the YAML list dash

Features
#1530 Support pinning branches to latest stable tags by the --branch-to-tag option
The default behabiour isn't changed.
By default, pinact doesn't pin branches such as main or master.
If you want to pin specific branches, you can use the --branch-to-tag option.
e.g.
pinact run --branch-to-tag '^main$' --branch-to-tag '^release/.*$'

Fixes
#1493 Preserve original line endings when updating workflows

Features
#1365 Make version separator configurable via configuration file @ReenigneArcher
#1372 Make version separator configurable via command line option and environment variable

🐛 Bug Fixes
#1359 Fix a bug that -log-color doesn't work

Others
- docs: fix readme for ignore_actions[].ref by @nasa9084 in #1323
- docs: fix readme for correct GHES_API_URL by @maruloop in #1324
- docs(INSTALL): add mise alternate installation documentation by @jylenhof in #1331