GitHub GA workflow dependency lockfiles fix SHA pinning flaw

GitHub has introduced workflow dependency lockfiles, addressing a security vulnerability where pinning an Action to a commit SHA could allow execution of malicious code from a fork network. The author confirms through testing that the new lockfiles successfully prevent forked-commit substitution attacks by rejecting unverified commits and mismatched histories. While limitations remain for external reusable workflows, this technical control shifts the verification burden away from developers manually checking commit strings. Open article →