Full-length commit SHA pinning means referencing a dependency by its exact Git commit hash, usually the 40-character SHA, instead of a branch name or tag. In Git-based automation such as GitHub Actions, this locks a workflow to one specific version of an action or reusable component.
This matters because branches and tags are mutable: their contents can change without the reference name changing. If an attacker compromises a repository, moves a tag, or replaces code behind a familiar name, workflows that trust the mutable reference may run different code than intended. Pinning to a full SHA makes that swap much harder. Defenders use it to reduce supply-chain risk, then update the pin only after reviewing a new commit. It is a practical control for treating third-party actions as executable dependencies, not static configuration.