GitHub Actions workflow lockfiles enter public preview, pinning dependencies to exact commits
A moved tag or branch can no longer silently change what a workflow runs, and admins can require lockfiles.
// Key points
- The lockfile at .github/workflows/actions.lock records exact commits for actions, transitive dependencies and reusable workflows, and runs use the recorded commits.
- It is generated with the gh actions-lock extension for the GitHub CLI, can be adopted one workflow at a time, and can be checked for staleness in CI without changing files.
- Enterprise, organization and repository admins can require lockfiles, also in public preview; when Dependabot updates an action it regenerates the matching lockfile entry in the same pull request.
- GitHub notes that locking doesn’t show whether a dependency is safe, so review dependencies before locking them.
Builder's takeThis site’s data pipeline and deploys run on Actions with storage keys in the workflows, so a third-party action’s tag being moved is exactly what worries me. I’d generate lockfiles for the deploy and publish workflows that hold secrets first, add the staleness check in CI, and only then consider requiring it at the organization level.