While researching GitHub Actions security best practices for a talk, I asked myself: "How many GitHub repositories actually pin their dependencies?"
As I was not able to find any hard numbers, I went to gather the data myself. The results (and raw data) are available at:
http://pin-gh-actions.kammel.dev/
The code is available on GitHub:
https://github.com/datosh/pinned-actions in case you want to replicate the data or report any issues.
