Versioning and pinning
Choose between a release tag, the moving v0 tag, and a commit SHA when referencing sfpm actions.
You can reference an sfpm action three ways. Each trades stability against convenience.
| Reference | Mutability | Use for |
|---|---|---|
vX.Y.Z (release tag) | Created once per release. Release tags are not force-pushed. | Audits, pinned production use |
v0 (moving major tag) | Moved on every release. | Convenience, trials |
| Commit SHA | Immutable. | Strictest supply-chain policies |
# Release tag
- uses: b64hub/sfpm/packages/actions/build@vX.Y.Z
# Moving major tag
- uses: b64hub/sfpm/packages/actions/build@v0
# Commit SHA of the release tag
- uses: b64hub/sfpm/packages/actions/build@<sha> # vX.Y.ZRelease tags
A release tag is the default choice for production workflows. The tag points to a fixed commit, so a workflow that references vX.Y.Z runs the same code until you change the reference.
The moving v0 tag
v0 is moved to each new release. A workflow that references v0 picks up new releases without a change to the workflow file. That is convenient, and it is also why v0 is a poor choice for a reproducible pipeline.
sfpm is pre-1.0. A minor release may include breaking changes to inputs, outputs, or behavior. If you reference v0, expect that a run may change after a release. Pin vX.Y.Z or a SHA when you need stability.
Commit SHAs
A commit SHA is immutable. Use one when your security policy requires pinning to an exact commit.
The SHA must be the commit that a release tag points to. Each release tag points to a commit that contains the action bundle. The bundle is not on main, and it is not on other commits. A SHA of a main commit or any other non-release commit will fail to run.
To find the commit a tag points to, run:
git rev-parse "vX.Y.Z^{commit}"Or copy the commit SHA shown on the GitHub release page.
Security fixes
Security fixes ship as patch releases on the current minor line. Only the latest release receives fixes before 1.0. The v0 tag is moved once a fix is released.
If you pin a release tag or a SHA, check the release list when a security fix ships, and update the pin.
See Security and network for the security posture of the actions and how to report a vulnerability.