> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pullfrog.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Versions & pinning

Your workflow references the action with a `uses:` ref — almost always the moving major tag `pullfrog/pullfrog@v0`. This page explains what that ref does and doesn't pin.

## How the action is versioned

The published action is a thin bootstrap. The real code behind both of its steps — the agent, and the post-run cleanup that persists rotated credentials — comes from npm at `^<version>`, so the behavior you care about tracks the latest release in the current major line.

The `uses:` ref fixes two things:

* The input and output contract, read from the action's `action.yml`.
* The npm range the bootstrap resolves, which is `^<version>` as of the pinned revision.

`pullfrog/pullfrog@v0` tracks the latest `v0.x` release. This is what the console emits and what we recommend.

## Pinning to a commit SHA

GitHub's [security hardening guide](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions) recommends pinning third-party actions to a full commit SHA, since tags are mutable. Tools like Dependabot, [StepSecurity](https://www.stepsecurity.io/), and `pin-github-action` apply this automatically, leaving the version as a comment:

```yaml theme={null}
uses: pullfrog/pullfrog@abc123… # v0
```

A pinned SHA takes both steps from npm the same way the tag does, so the agent and the cleanup step stay current across `0.x` patches. Refreshing the pin is what picks up a new minor. Dependabot bumps the SHA and the `# v0` comment together:

```yaml theme={null}
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
```

## Choosing a ref

| You want… | Use |
| - | - |
| The simplest setup that always stays current | `pullfrog/pullfrog@v0` |
| SHA pinning for a security policy | a commit SHA, with Dependabot to pick up new minors |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.