GitHub Actions Lockfiles: What gh actions-lock Pins and What It Leaves Loose

GitHub made Actions workflow lockfiles generally available on October 28, 2026, so a workflow can keep readable references such as actions/checkout@v7.0.1 while Actions runs a commit recorded in .github/workflows/actions.lock. Hugo van Kemenade described his migration on November 11, in a post that drew 159 points on Hacker News.

The GitHub changelog covers the Free, Team, Enterprise Cloud and Enterprise Cloud with data residency plans. The extension that writes the file, gh-actions-lock, is MIT-licensed, had 330 stars when we read it, and has no tagged release on its Releases page.

What problem a lockfile solves in GitHub Actions

Actions are fetched from Git, and a tag can be moved to different code after you start trusting it. Van Kemenade writes that "because GitHub Actions are fetched from Git, the previous advice was to pin to a full SHA instead of a tag." SHA pins work but leave workflows full of 40-character hashes that nobody can read in review.

The lockfile splits the two jobs. The workflow keeps a tag for humans, and the lockfile records, per van Kemenade, the commit SHA plus the owner ID and repository ID of each dependency. The changelog says the file covers actions and their transitive dependencies, and that Actions runs "the exact commits you locked, even if those references move."

The commands in gh actions-lock

Install with gh extension install github/gh-actions-lock. The README lists these modes.

Command	What it does
gh actions-lock	Pins resolvable actions and writes the lockfile
--relock	Moves refs such as v4 or main to current upstream commits
--verify	CI check, same logic as a fix without writing files
--verify-local	Offline check that each uses: has an entry, with no provenance check

Teams can adopt it one workflow at a time. Once a workflow is onboarded, every dependency it uses must be in the lockfile. Enterprise, organization and repository administrators can enforce adoption with a Require lockfile policy.

Dependabot opens its usual version-update pull request and regenerates the matching lockfile entry in the same PR, with no extra configuration, according to the changelog. Van Kemenade says Renovate supports lockfiles too.

Four things a lockfile does not lock

The README is blunter than the announcement about limits.

• Reusable workflows called from another repository at jobs.<id>.uses are not locked, tracked in issue #179.
• Container images are not locked. Any image without an @sha256: digest produces a warning, tracked in issue #236.
• Local ./ actions are not followed. If one pulls in remote actions, that is a blocking error unless you pass --migrate-local-actions or --ignore-local-actions.
• A ref moved back to an older commit in its own history is not detected, so the README advises reviewing lockfile diffs or pinning exact tags.

The changelog adds its own warning: lockfiles "don't determine whether a dependency is safe." A lockfile freezes whatever you reviewed, or failed to review, on the day you ran it. The --accept-moved flag exists, and the README warns against using it in automation. The --no-narrow flag keeps partial versions such as v4 in the workflow instead of rewriting them to exact tags, which matters for anyone who wants diffs to stay small. Both flags change what a reviewer sees in a pull request, so they are worth reading before the first run.

How van Kemenade wired it into CI

He adds a separate lockfile job to his lint workflow on ubuntu-slim, installs gh-actions-lock pinned to v0.4.1, and runs gh actions-lock --verify. He notes that pinned version will need periodic updating. He also recommends the zizmor security linter, whose v1.32.0 is the first release to support lockfiles. Earlier versions still tell users to hash-pin. His example pull requests include python-pillow/Pillow#10428 and python/cpython#161811.

The supply-chain background is the tj-actions/changed-files attack, which van Kemenade links to a Legit Security writeup as the case for mutable-tag risk. For how a build pipeline's secrets get reached in practice, see our report on the Chainstack Grafana MCP intrusion. Tooling that moves agent sessions between machines raises similar trust questions, as in Atuin Threads.

GitHub Enterprise Server is not supported by the extension. The README names only github.com and data-residency hosts.