Pin CI workflow actions and images with Ratchet
Audit and rewrite CI/CD workflow references so agents can pin mutable actions, containers, and images to immutable versions before changes land.
npx skills add agentskillexchange/skills --skill pin-ci-workflow-actions-and-images-with-ratchet
Use this skill when an agent or release operator needs to harden CI configuration against supply-chain drift. The workflow is to run Ratchet against GitHub Actions, GitLab CI, CircleCI, Cloud Build, Drone, or Tekton YAML; inspect lint findings for mutable references; pin actions/images to immutable commits or digests; and update or unpin intentionally when maintaining the workflow. Invoke it during CI security review, repository onboarding, dependency hardening, or automated pull-request cleanup rather than manually editing workflow YAML. Scope boundary: this is not a generic CI tool listing; the skill is the concrete audit/pin/update loop for immutable CI references with reviewable file diffs.