Original announcement: · Reporting prepared on the publication date above.
What to know
- Workflow lockfiles now pin action dependencies to exact commits while keeping readable references in YAML.
What changed
GitHub made Actions workflow dependency lockfiles generally available on October 28 for supported Free, Team and Enterprise Cloud plans. A workflow can keep readable tags while the lockfile records the exact commits, including transitive dependencies. Administrators can require lockfiles through policy.
Why deployment teams care
A moving tag can point to different code between two deployments. Pinning makes a build more reproducible and narrows surprise changes, but a pinned dependency is not automatically trustworthy. Review the action before locking it and keep updates deliberate.
If GitHub Actions deploys to your VPS, combine lockfiles with limited permissions, reviewed changes and short-lived credentials. The secure deployment guide has the broader checklist.
Sources & further reading
Primary sources supporting this article. The practical recommendations are Kiava’s general guidance and should be adapted to your project.
Your experience. The next chapter.
Tried this guide, or have a question? Add your experience to the conversation.
This conversation starts with you.
A useful question or a short experience can help the next reader.
Discussion 0
Newest first