Versions & pinning - Pullfrog

Your workflow references the action with a uses: ref — almost always the moving major tag pullfrog/pullfrog@v0. This page explains what that ref does and doesn’t pin.

How the action is versioned

The published action is a thin bootstrap. The real code behind both of its steps — the agent, and the post-run cleanup that persists rotated credentials — comes from npm at ^<version>, so the behavior you care about tracks the latest release in the current major line. The uses: ref fixes two things:

The input and output contract, read from the action’s action.yml.
The npm range the bootstrap resolves, which is ^<version> as of the pinned revision.

pullfrog/pullfrog@v0 tracks the latest v0.x release. This is what the console emits and what we recommend.

Pinning to a commit SHA

GitHub’s security hardening guide recommends pinning third-party actions to a full commit SHA, since tags are mutable. Tools like Dependabot, StepSecurity, and pin-github-action apply this automatically, leaving the version as a comment:

uses: pullfrog/pullfrog@abc123… # v0

A pinned SHA takes both steps from npm the same way the tag does, so the agent and the cleanup step stay current across 0.x patches. Refreshing the pin is what picks up a new minor. Dependabot bumps the SHA and the # v0 comment together:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly

Choosing a ref

You want…	Use
The simplest setup that always stays current	`pullfrog/pullfrog@v0`
SHA pinning for a security policy	a commit SHA, with Dependabot to pick up new minors