Lock Your GitHub Actions

8 relevance

Locking GitHub Actions is directly actionable for CI/CD security, highly relevant to platform engineering.

Open Source hugovk.dev

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For platform engineers managing CI/CD pipelines, this eliminates the trade-off between readability and security in action pinning, and integrates with existing dependency update tools to reduce manual lockfile maintenance.

Key Takeaways

Adopt `gh actions-lock` to convert SHA-pinned workflows to tag-based references with a verified lockfile, and add `--verify` to CI to catch drift automatically.

Summary

GitHub Actions now supports workflow lockfiles via the `gh actions-lock` CLI extension, replacing the previous best practice of pinning actions to full SHAs. The lockfile maps tags to immutable commit hashes, enabling readable `vX.Y.Z` references while preventing supply-chain attacks from mutable tags. Renovate and Dependabot already support lockfile updates, and CI verification with `gh actions-lock --verify` ensures lockfiles stay in sync.

Author

Hugo van Kemenade