GitHub Actions finally gets lockfiles, ending the SHA-pinning era
Lock Your GitHub Actions
GitHub Actions now supports workflow lockfiles, so you can reference actions by version tag instead of pasting full commit SHAs. Hugo van Kemenade walks through installing the gh-actions-lock extension, running gh actions-lock to generate .github/workflows/actions.lock, and validating it in CI with a dedicated job. Renovate and Dependabot already update lockfiles, and zizmor v1.32.0 supports them too. The lockfile pins each tag to a verified commit, keeping supply-chain protection without the hash clutter.
Because GitHub Actions are fetched from Git, the previous advice was to pin to a full SHA instead of a tag. This is because tags are mutable and susceptible to supply-chain attacks where an attacker points a previously safe tag at malicious code.