{
  "description": "Pin GitHub Actions and reusable workflows to commit SHAs, or check that they are pinned. Token handling and SARIF output are left out.",
  "name": "pinact",
  "subcommands": [
    {
      "name": "run",
      "description": "Pin actions in workflows",
      "options": [
        {
          "names": [
            "--check"
          ],
          "description": "Report unpinned actions without editing files."
        },
        {
          "names": [
            "--update"
          ],
          "description": "Update actions"
        },
        {
          "names": [
            "--verify-comment"
          ],
          "description": "Verify version comments"
        },
        {
          "names": [
            "--branch-to-tag"
          ],
          "description": "Pin branches"
        },
        {
          "names": [
            "--no-api"
          ],
          "description": "Offline check"
        }
      ],
      "args": [
        {
          "name": "files",
          "description": "Defaults to the repository's workflow and action files when empty.",
          "isOptional": true,
          "isVariadic": true,
          "template": "filepaths"
        }
      ]
    }
  ]
}