What's the recommended way to install the right version of the tool?

[webmaster128]

Heyhey! Love this product idea and want to give it a try. However, I see many examples contain a hash for the version of autofix. I think this is very inconvenient as those hashes are different and I have no idea if they are very outdated or the right ones. E.g.

      - uses: autofix-ci/action@dd55f44df8f7cdb7a6bf74c78677eb8acd40cd0a

here, or

      - uses: autofix-ci/action@8bc06253bec489732e5f9c52884c7cace15c0160

here, and

    - uses: autofix-ci/action@hash

here.

I am not horribly familiar with versioning of GitHub actions but as a user I would ideally like to do something like give me the latest ^1.0.0. But the v1 tag seems to be a v1.0.0 and not moving.

I will try v1.3.1 for now, hoping this is a reasonable choice. Cheers!

[mhils]

Hi @webmaster128!

My recommendation is to follow https://autofix.ci/setup, which always has the latest version. I would not worry about updating as long as things work. If we should become aware of a security issue, we'll disclose it on GitHub and Dependabot will come poke at you. :)

We suggest to pin the action to a specific hash to make your workflow more resilient against supply chain attacks. A tag is mutable can be modified to point to a different commit. If a bad actor would somehow manage to gain access to the autofix repository in the future, they could execute malicious code in your pipeline if you use @v1. This can be mitigated by pinning to a specific commit instead. You can find more details at https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions.

The previous paragraph is not specific to autofix.ci - this basically applies to any third-party GitHub action. I'm just trying to nudge folks to secure-by-default . :)

[mscheltienne]

I'll chime in and say that the pin to a hash instead of to a tag is strange and difficult to work with. I like to use up-to-date code, and for instance the hash on the setup page is 2 commits behind.

uses: autofix-ci/action@dd55f44df8f7cdb7a6bf74c78677eb8acd40cd0a

The tag v1.3.1 (and its corresponding release) are actually more up-to-date.

[mhils]

the hash on the setup page is 2 commits behind.

Thanks for the heads-up. This is supposed to sync automatically, I fixed it.

I will maintain @v1 etc going forward, you are welcome to use that. The default recommendation will remain the pinned version for the time being.

[Avasam]

Case in point about using commit hash, tj-actions/changed-files recently got compromised:

• stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
• Multiple tags in this action are compromised tj-actions/changed-files#2463
• news.ycombinator.com/item?id=43372246
• CVE-2025-30066