GoKawiilGitHub Actions adds workflow lockfiles via new gh-actions-lock tool
GitHub Actions now supports lockfiles that let workflows reference version tags like v7.0.1 instead of full commit SHAs while still pinning to a specific commit. A new gh CLI extension, gh-actions-lock, generates a .github/workflows/actions.lock file recording the exact commit hash tied to each tag used in a repo's workflows.
GoKawiil's interpretation of the reporting above, not reported fact.
Pinning Actions to mutable tags has long been considered risky because an attacker could redirect a tag to malicious code, which is why SHA-pinning became standard advice. Lockfiles could let developers keep the readability of version tags while automated tooling verifies the underlying commit hasn't changed, potentially easing adoption of safer pinning practices across GitHub Actions workflows.
- GitHub Actions now supports lockfiles pairing human-readable tags with pinned commit hashes.
- The gh-actions-lock CLI extension automates converting SHA-pinned workflows to tag references plus a lockfile.
- The approach aims to balance supply-chain security against the readability drawbacks of raw SHA pinning.
Source: hugovk.dev — Hugo Van Kemenade, 2026-11-11
Published there as: “Lock Your GitHub Actions”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.