How can I pin specific Git SHA versions?

[ghinch]

Following the recent Trivy incident, we have made the decision we must pin all Github actions to specific commit SHAs. This is in line with Github's own documentation on securing your actions.

However this does not appear to work with terraform-github-actions.

For example if I set a step to a recent commit like this:

uses: dflook/terraform-plan@7878bff63e2099cdc9be9a6f33cbbbf687f8f0fe # v2.2.3

When the action runs It has an error because Github can't find the associated file:

Error: An action could not be found at the URI 'https://api.github.com/repos/dflook/terraform-apply/tarball/7878bff63e2099cdc9be9a6f33cbbbf687f8f0fe' (3964:257795:13FA84:1AEB7C:69C6472B)

Is there a config option I am missing to make this work with the terraform-github-actions? I have not had the same issue with any other Github action.

[ghinch]

Ignore me as soon as I posted I saw the issue, the SHA is for plan and the error is on apply 🤦