GitHub Actions lockfiles let you pin tags and run exact commits

A GitHub Actions workflow that reads uses: actions/checkout@v4 is trusting a tag, and a tag can move. GitHub made workflow lockfiles generally available on 28 October. The feature lets a team keep the readable tag in the YAML. It also pins the exact commit that tag resolved to the day the lockfile was written. On 11 November, the Python developer Hugo van Kemenade published a walkthrough of how to adopt it. The post took 181 points on Hacker News.

What the feature does

GitHub writes that users can "keep readable tag references in your workflows while running the exact commits you locked". A new CLI extension, gh actions-lock, generates a .github/workflows/actions.lock file. The lockfile records the commit hash for every action the workflow uses. Transitive dependencies are pinned too.

Hugo's walkthrough names five steps. Install the gh actions-lock extension. Run the command in the repository. Commit the modified workflows and the new lockfile. Add a CI job that runs gh actions-lock --verify. Update the zizmor security linter to v1.32.0 or newer.

Who it is for

Teams that pin to a full commit SHA are safer than those running a tag. GitHub has recommended SHA pinning for years. A 40-character hash in every uses: line is unreadable. Reading one on review takes more time than nobody will spend. The lockfile keeps actions/checkout@v4 in the workflow and puts the SHA in a file next to it. A reviewer sees the tag and the diff of the lockfile.

Hugo names four real projects that already adopted the feature: Pillow, CPython, Python's release-tools and miss-islington. Those are open-source projects run by Python's own maintainers.

How updates work

GitHub says Dependabot keeps the lockfile in sync. Renovate supports it too. A dependency update becomes one pull request that changes the lockfile. The YAML stays readable. The security linter zizmor reads the lockfile from v1.32.0 onward and warns on a stale pin.

An administrator can require it with a policy called "Require lockfile". The policy applies on GitHub Enterprise Cloud, Enterprise Cloud with data residency, Team and Free plans. GitHub lists the policy page in its docs.

What this does not fix

A lockfile pins the commit, not what the commit does. A hacked maintainer who pushes a bad release can still get you to update the lockfile. That is still a supply chain attack. The feature raises the cost and removes the silent-tag-move case. It is not the whole answer.

Source

GitHub, "GitHub Actions workflow lockfiles are generally available", 28 October 2026. Hugo van Kemenade, "Lock Your GitHub Actions". Hacker News discussion.