--- title: brew install actions/checkout | daily.dev description: A deep technical exploration of using Homebrew's tap infrastructure as a curated, security-hardened distribution layer for GitHub Actions. The author... canonical: https://daily.dev/posts/brew-install-actions-checkout-0egcwzcef twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: brew install actions/checkout | daily.dev og:description: A deep technical exploration of using Homebrew's tap infrastructure as a curated, security-hardened distribution layer for GitHub Actions. The author... og:url: https://daily.dev/posts/brew-install-actions-checkout-0egcwzcef og:image: https://api.daily.dev/og/posts/0EgcwZceF.png og:image:alt: brew install actions/checkout og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # brew install actions/checkout **[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 10 min read · 4 upvotes · 1 comments ## Summary A deep technical exploration of using Homebrew's tap infrastructure as a curated, security-hardened distribution layer for GitHub Actions. The author demonstrates how Homebrew formulae can pin action tarballs by SHA-256, resolve transitive composite action dependencies via `depends_on` and `inreplace`, and leverage OCI artifact storage on ghcr.io — the same backend already used by immutable actions. A prototype tap covering 70 critical actions is described, including zizmor static analysis integration for audit gates, vulnerability lookup via OSV, and three integration paths for getting the runner to consume installed packages. The post also covers how Gitea/Forgejo runners could adopt this approach without GitHub backend changes, and envisions GitHub natively integrating a tap-based resolver as an org-level setting. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does GitHub Actions runner 2.336.0's new $/ self-repository syntax differ from the ./ path prefix for referencing actions? The $/ prefix, added in runner 2.336.0, anchors at the repository containing the defining file and resolves at the running commit, and it is readable before any step has run, unlike ./ which is anchored at $GITHUB_WORKSPACE and requires checkout to run first. Unlike ./, $/ is also valid for reusable workflows, such as uses: $/.github/workflows/foo.yml. However, inside a composite action loaded via ./, references to $/ still resolve against the workflow's repository rather than the copied directory, causing resolution failures for nested relative paths like $/../actions-cache. _Teams pinning composite actions carefully can track runner syntax changes like this via daily.dev before workflows break._ ### What security issues did scanning GitHub Actions with zizmor typically find across popular actions? Running zizmor 1.28.0 over the extracted action.yml files of the 70 actions in ecosyste.ms' critical set reported 61 findings across seven actions, with 45 being high-severity, high-confidence findings in five actions: 40 template-injection issues and five unpinned-uses issues. Additionally, five of six Docker actions referenced their base image by tag rather than digest, and one action lacked a license file entirely. _Auditing third-party actions for template-injection and unpinned refs is easier to stay on top of via daily.dev._ ### What did GitHub's 2026 security roadmap commit to for improving GitHub Actions supply chain security? GitHub's 2026 security roadmap committed to introducing a lockfile, now in preview as gh-actions-lock, and to making immutable actions the preferred resolution path. Immutable actions work by having actions/publish-immutable-action tar the action directory, push it as an OCI layer to ghcr.io tagged with the semver, and attach a sigstore bundle, so workflows referencing a version like actions/checkout@4.2.2 resolve through pkg.actions.githubusercontent.com instead of a git tarball. Neither change adds review between an action author tagging a release and the runner executing it. _Anyone tracking GitHub Actions lockfile and immutable-action rollout can follow the changes on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@agustinbarrientos** · 1 upvotes > I'd choose the reviewed tap over another floating `@v4` tag after seeing 61 findings across seven critical actions ## Similar posts on daily.dev - [Securing GitHub Actions CI dependencies: Recipe card](https://daily.dev/posts/securing-github-actions-ci-dependencies-recipe-card-ttkzb5tpj) · CNCF · 0 upvotes · 0 comments - [Securing CI/CD for an open source project: Locking down dependencies](https://daily.dev/posts/securing-ci-cd-for-an-open-source-project-locking-down-dependencies-so0u2d8g2) · CNCF · 25 upvotes · 0 comments - [The Future Of GitHub Actions Security And What You Can Do Right Now](https://daily.dev/posts/the-future-of-github-actions-security-and-what-you-can-do-right-now-feutrlsv2) · GitGuardian · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/brew-install-actions-checkout-0egcwzcef) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"brew install actions/checkout","url":"https://daily.dev/posts/brew-install-actions-checkout-0egcwzcef","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/brew-install-actions-checkout-0egcwzcef"},"datePublished":"2026-08-04T10:24:51.707Z","dateModified":"2026-09-14T06:41:33.062Z","description":"A deep technical exploration of using Homebrew's tap infrastructure as a curated, security-hardened distribution layer for GitHub Actions. The author...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Andrew Nesbitt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Andrew Nesbitt","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/nesbitt-io"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/brew-install-actions-checkout-0egcwzcef","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,cicd,github-actions","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Andrew Nesbitt","item":"https://daily.dev/sources/nesbitt-io"},{"@type":"ListItem","position":3,"name":"brew install actions/checkout"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/brew-install-actions-checkout-0egcwzcef","comment":[{"@type":"Comment","text":"I’d choose the reviewed tap over another floating @v4 tag after seeing 61 findings across seven critical actions","datePublished":"2026-08-06T01:27:51.496Z","url":"https://daily.dev/posts/0EgcwZceF#c-qhtldh4xz","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/brew-install-actions-checkout-0egcwzcef#faq","mainEntity":[{"@type":"Question","name":"How does GitHub Actions runner 2.336.0's new $/ self-repository syntax differ from the ./ path prefix for referencing actions?","acceptedAnswer":{"@type":"Answer","text":"The $/ prefix, added in runner 2.336.0, anchors at the repository containing the defining file and resolves at the running commit, and it is readable before any step has run, unlike ./ which is anchored at $GITHUB_WORKSPACE and requires checkout to run first. Unlike ./, $/ is also valid for reusable workflows, such as uses: $/.github/workflows/foo.yml. However, inside a composite action loaded via ./, references to $/ still resolve against the workflow's repository rather than the copied directory, causing resolution failures for nested relative paths like $/../actions-cache. Teams pinning composite actions carefully can track runner syntax changes like this via daily.dev before workflows break."}},{"@type":"Question","name":"What security issues did scanning GitHub Actions with zizmor typically find across popular actions?","acceptedAnswer":{"@type":"Answer","text":"Running zizmor 1.28.0 over the extracted action.yml files of the 70 actions in ecosyste.ms' critical set reported 61 findings across seven actions, with 45 being high-severity, high-confidence findings in five actions: 40 template-injection issues and five unpinned-uses issues. Additionally, five of six Docker actions referenced their base image by tag rather than digest, and one action lacked a license file entirely. Auditing third-party actions for template-injection and unpinned refs is easier to stay on top of via daily.dev."}},{"@type":"Question","name":"What did GitHub's 2026 security roadmap commit to for improving GitHub Actions supply chain security?","acceptedAnswer":{"@type":"Answer","text":"GitHub's 2026 security roadmap committed to introducing a lockfile, now in preview as gh-actions-lock, and to making immutable actions the preferred resolution path. Immutable actions work by having actions/publish-immutable-action tar the action directory, push it as an OCI layer to ghcr.io tagged with the semver, and attach a sigstore bundle, so workflows referencing a version like actions/checkout@4.2.2 resolve through pkg.actions.githubusercontent.com instead of a git tarball. Neither change adds review between an action author tagging a release and the runner executing it. Anyone tracking GitHub Actions lockfile and immutable-action rollout can follow the changes on daily.dev."}}]} ```