Pinact is a CLI tool to edit GitHub Workflow and Composite action files to pin versions of GitHub Actions and Reusable Workflows. It enhances security by converting mutable version references (like tags) into immutable commit SHA hashes with version annotations.