diff --git a/rule-types/github/actions_check_pinned_tags.yaml b/rule-types/github/actions_check_pinned_tags.yaml index bf38a0f..ec49bd1 100644 --- a/rule-types/github/actions_check_pinned_tags.yaml +++ b/rule-types/github/actions_check_pinned_tags.yaml @@ -81,12 +81,12 @@ def: # Check if the step has a uses directive not is_null(s.uses) - # Skip if the full name of the action is part of excludes - not is_excluded(s.uses, input.profile.exclude) - # Split the uses directive at '@' parts := split(s.uses, "@") + # Skip if the action name is part of excludes + not is_excluded(parts[0], input.profile.exclude) + # Check if the string after '@' is 40 characters long (SHA-1 hash length) count(parts[1]) != 40