BuildRiot
Sign in

CloudSource: GitHub

GitHub previews dependency lockfiles for Actions workflows

By News DeskPublished here (UTC)1 min read
Electric-blue workflow dependency branches pin into a cream-colored manifest slab, while loose red branches hover against a near-black background.
Illustration: BuildRiot (AI-generated)

GitHub Actions workflow dependency lockfiles are in public preview for Free, Team, Enterprise Cloud, and Enterprise Cloud with data residency. According to GitHub, the gh actions-lock extension generates.github/workflows/actions.lock to pin action dependencies to exact commits. These dependencies include transitive actions and reusable workflow references. Teams can adopt locking one workflow at a time. Dependencies inside a reusable workflow use the lockfile in the repository that defines that workflow. Sources: GitHub, GitHub Docs

Why it matters

GitHub says locking preserves selected commits when upstream tags or branches change, but cautions that pinning a commit does not establish its safety. [2] Developers should review the generated diff and check action allowlists. [3]

Attribution

Sources

  1. 1GitHubGitHub Actions workflow lockfiles in public previewSource published (UTC)
  2. 2GitHub DocsWorkflow dependency lockfiles
  3. 3GitHub DocsLocking action dependencies in a repository's workflows
  4. 4GitHub DocsEnforcing lockfiles for action dependencies
  5. 5byteiotaGitHub Actions 2026 Security Roadmap: What Changes Now

Read the original source for full details and context.

Report a problem

Links, dates or what you expected. Do not include passwords or private data.

More on Cloud

All Cloud stories

AI

Vercel reports production sandbox host-memory leakage

Vercel reported production host-memory leakage and host code execution from the same flaw on researcher-owned test machines. The findings put host patching, network policies and snapshot ownership under scrutiny for teams running untrusted agent code.

Vercel

Article · Cloud

Test GitHub Actions lockfiles by moving a nested action’s tag

GitHub’s workflow lockfile preview covers nested action dependencies beyond a top-level commit pin. This guide sets up a controlled moved-tag experiment, separates execution from dependency updates, and explains what to check before enforcing lockfiles.

GitHub