GitHub Actions has added lock files

GitHub Actions now supports workflow dependency lockfiles in public preview for Enterprise Cloud and Enterprise Cloud with data residency, letting workflows record the exact commits of actions and reusable workflows they depend on. Because tags and branches can move after a workflow is reviewed, an unpinned reference can cause later runs to execute different - and potentially malicious - code; lockfiles bind runs to the commits recorded at lock time to prevent unexpected dependency changes. Locking does not vouch for a dependency’s safety, so dependencies should be reviewed before being locked.

A new gh actions-lock extension for the GitHub CLI generates and maintains .github/workflows/actions.lock, including transitive and reusable workflow dependencies, and supports gradual onboarding so workflows must include lockfile entries once enabled. GitHub Actions enforces recorded commits for onboarded workflows, and the tool can check for stale lockfiles without modifying files. Administrators can enforce lockfile use via a REQUIRE LOCKFILE policy (also in preview). Dependabot will update action versions and regenerate corresponding lockfile entries in the same pull request to keep references and locked commits in sync. Getting started involves installing the gh-actions-lock extension, reviewing and committing the generated lockfile, and following docs or opening issues on the gh-actions-lock repository for feedback.