GitHub Actions workflow lockfiles in public preview
GitHub has introduced workflow dependency lockfiles for GitHub Actions, currently available in public preview. This feature is restricted to GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency.
Verified State Diff
Impact & Verification Analysis
GitHub Enterprise Cloud users and developers managing CI/CD pipelines with strict security requirements.
It significantly hardens the CI/CD pipeline by mitigating the risk of malicious or accidental code injection through mutable workflow references.
Full Fact Overview
The introduction of lockfiles for GitHub Actions workflows addresses the security and stability risks associated with mutable references like tags and branches. By pinning dependencies to specific hashes, organizations can ensure that workflow execution remains deterministic and immutable, preventing 'dependency confusion' or unauthorized code changes if a tag or branch is updated after a security review. This implementation aligns GitHub Actions with standard software supply chain security practices used in package managers like npm or pip.