GitHub Actions workflow lockfiles

GitHub has announced public preview availability for GitHub Actions workflow dependency lockfiles. The feature addresses a common supply chain risk: tags and branches can move after a workflow is reviewed, meaning a later run may execute different code than what was originally approved. Lockfiles preserve the human-readable references in the workflow while ensuring the exact locked commits are executed.

The core capability is commit-level pinning of workflow dependencies. If an action is compromised, a moved tag or branch could otherwise introduce malicious code without any change to the repository. Lockfiles protect against these unexpected dependency changes, giving teams a verifiable record of what actually runs in their pipelines.

The preview is available for GitHub Enterprise Cloud, GitHub Enterprise Cloud with data residency, Team, and Free plans. The changelog also highlights integration with Dependabot, which can keep locked dependencies up to date so security fixes are not blocked by pinned versions.

This feature suits DevOps engineers, platform teams, and security-conscious organizations that maintain CI/CD workflows and want stronger guarantees about the code executed in automation. Teams adopting it should plan a process for reviewing and refreshing lockfile updates, ideally pairing it with Dependabot alerts.

Overall, workflow lockfiles are a practical hardening step for GitHub Actions users concerned about dependency drift and supply chain attacks.