Lockfile

GitHub has made workflow dependency lockfiles generally available for GitHub Actions, with runners executing the commit hashes recorded in actions.lock regardless of later tag or branch changes. The mechanism pins both direct and transitive dependencies, backed by the gh actions-lock CLI extension, Dependabot synchronization and an admin-enforced Require lockfile policy, closing gaps left by manual SHA pinning.