rosshamish/kuskus/kuskus-sha-pins

Claude Code and agent skill by rosshamish/kuskus

Trust tier 3
  • community
Source check pending

Checking that the SKILL.md file is still in the repository.

How to update SHA-pinned GitHub Actions in kuskus workflows

Install

npx vskill@latest install rosshamish/kuskus/kuskus-sha-pins

SKILL.md

SHA-Pin Update Runbook

All actions in .github/workflows/ are pinned to full commit SHAs for security. When a new action version is released, update the SHA manually.

Current Pinned Actions

ActionSHAVersion
actions/checkout11bd71901bbe5b1630ceea73d27597364c9af683v4
actions/setup-node49933ea5288caeca8642d1e84afbd3f7d6820020v4
phips28/gh-action-bump-version2d294fcd028d7ec0de2fa4e94ad7fe04512cc13av11.1.2
HaaLeo/publish-vscode-extensionf4ece70f329f66686bd71c54b1671353fe320e49v1

List All Pinned Actions

bash
grep -r 'uses:.*@[0-9a-f]\{40\}' .github/workflows/

Find the Current SHA for an Action

Option A: gh api (recommended)
bash
# Get SHA for a specific tag
gh api repos/actions/checkout/git/refs/tags/v4 --jq '.object.sha'
 
# If the tag points to a tag object (not a commit), dereference it
gh api repos/actions/checkout/git/refs/tags/v4 --jq '.object.url' \
  | xargs gh api --jq '.object.sha'
Option B: git ls-remote
bash
git ls-remote https://github.com/actions/checkout refs/tags/v4

Update a SHA Pin

Workflow files use the pattern:

yaml
uses: owner/action@<SHA>  # vX.Y.Z

Steps:

  1. Find the new SHA using one of the methods above
  2. Replace the old SHA in every workflow file that references the action:

``bash OLD_SHA=11bd71901bbe5b1630ceea73d27597364c9af683 NEW_SHA=<new-sha> sed -i '' "s/$OLD_SHA/$NEW_SHA/g" .github/workflows/*.yml ``

  1. Update the version comment to match the new tag (e.g., # v4.2.0)
  2. Update the table above in this file
  3. Commit on an ops/ branch and open a PR

Workflow Files That Use SHA Pins

FileActions pinned
kusto-language-server-pr-validation.ymlcheckout, setup-node
kusto-language-server-publish.ymlcheckout, setup-node, gh-action-bump-version, publish-vscode-extension
kusto-color-themes-pr-validation.ymlcheckout
kusto-color-themes-publish.ymlcheckout, gh-action-bump-version, publish-vscode-extension
kusto-syntax-highlighting-pr-validation.ymlcheckout
kusto-syntax-highlighting-publish.ymlcheckout, gh-action-bump-version, publish-vscode-extension
kusto-extensions-pack-pr-validation.ymlcheckout
kusto-extensions-pack-publish.ymlcheckout, gh-action-bump-version, publish-vscode-extension

Security

  • Security scanPassed, 90 of 100Pattern checks on the skill's files.
  • Model reviewPassed

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

Repository stars
50
Repository forks
13
7-day trend score
20

Stars and forks are for the whole GitHub repository, not this skill alone. Refreshed 20 Mar 2026, 7 months ago.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/rosshamish/kuskus/kuskus-sha-pins/badge)](https://verified-skill.com/skills/rosshamish/kuskus/kuskus-sha-pins)

Something wrong with this skill or its page? Tell us.