Lock Your GitHub Actions

GitHub Actions now supports workflow lockfiles, offering a way to use readable version tags without giving up the protection of pinning each action to an exact commit. Tags can be changed, creating a supply-chain risk if a trusted tag is redirected to malicious code. The `gh-actions-lock` extension converts workflows from full SHA references to version tags and creates `.github/workflows/actions.lock`, which records each action’s tag, commit hash, and repository identifiers. The lockfile should be committed alongside the updated workflows.

The setup also recommends keeping the lockfile current with Renovate or Dependabot, both of which support it, and using cooldowns for dependency updates. A CI job can run `gh actions-lock verify` to detect a missing or out-of-sync lockfile and confirm that locked references still match upstream; the example runs this in parallel with linting on a lightweight runner. Any workflow changes may require regenerating the lockfile. For security checks, the guide strongly recommends the zizmor GitHub Actions linter, noting that lockfile support begins with version 1.32.0; earlier versions may instead demand SHA pins. The example pins the lockfile extension itself to v0.4.1, which will eventually need updating or automation.