Replace git tags in GitHub Actions with commit hashes

replace-action-tags-with-revs.sh

#!/bin/sh
# Replace version tags with commit hashes in github actions workflows
# Example: "uses: actions/checkout@v4"
# -> "uses: actions/[email protected] #v4"

for workflow in .github/workflows/*.yml; do
    grep -E "uses:[[:space:]]+[A-Za-z0-9._-]+/[A-Za-z0-9._-]+@v[0-9]+" "$workflow" | while read -r line; do
        repo=$(echo "$line" | sed -E 's/.*uses:[[:space:]]+([A-Za-z0-9._-]+\/[A-Za-z0-9._-]+)@v[0-9]+.*/\1/')
        tag=$(echo "$line" | sed -E 's/.*@((v[0-9]+)).*/\1/')
        commit_hash=$(git ls-remote "https://github.com/$repo.git" "refs/tags/$tag" | cut -f1)
        [ -n "$commit_hash" ] && sed -i.bak -E "s|(uses:[[:space:]]+$repo@)$tag|\1$commit_hash #$tag|g" "$workflow" && rm -f "$workflow.bak"
    done
done

I learned this from Hacker News comment: https://news.ycombinator.com/item?id=43367987#43374144