GitHub Actions adds workflow dependency lockfiles

The author explains that CI/CD pipelines need workflow dependency lockfiles, much like application package managers, to secure software supply chains. While GitHub Actions workflows often use mutable tags or long commit SHAs, the introduction of workflow dependency lockfiles via extensions like actions.lock allows developers to keep readable references while locking exact commits. However, the author notes that while lockfiles improve consistency, they do not automatically make dependencies trustworthy or protect against all build inputs. Open article →