gh-actions-lock

GitHub has made workflow dependency lockfiles generally available for GitHub Actions, with runners executing the commit hashes recorded in actions.lock regardless of later tag or branch changes. The mechanism pins both direct and transitive dependencies, backed by the gh actions-lock CLI extension, Dependabot synchronization and an admin-enforced Require lockfile policy, closing gaps left by manual SHA pinning.

GitHub Actions has made workflow lockfiles generally available, offering a managed alternative to manually pinning actions to full commit SHAs to defend against mutable-tag supply chain attacks. The author walks through installing the gh-actions-lock CLI extension and generating lockfiles. The feature lowers the maintenance burden of securing CI/CD pipelines and is immediately actionable for developers relying on GitHub Actions.