pin

pin, by actsense, resolves a version to the hash behind it. A tag like nginx:1.27 or actions/checkout@v4 can be moved to different code at any time, while a digest or commit SHA always names the same bytes. I contribute to pin. Try it at pin.actsense.dev.

What it resolves

• Container images on Docker Hub, GHCR, and the GitLab.com registry, to their sha256 digest.
• GitHub Actions, composite actions, reusable workflows, and Git submodules, to a commit SHA.
• npm packages, to their SRI integrity hash, and PyPI releases, to the sha256 of each sdist and wheel.
• Web URLs pasted straight from the browser, such as a Docker Hub, GitHub, npm, or PyPI page.
• Whole files, such as a workflow, a Dockerfile, a package.json, or a requirements file, with every reference in them resolved in one scan.

How it works

pin is a single Cloudflare Pages site with Pages Functions. Every resolved reference is written to Workers KV once and served from that cache after that, so the same reference always resolves to the same digest.