GitHub Actions lockfiles become generally available to pin workflow dependencies

Pinned commits now run even when tags or branches move, but the lockfile does not vouch that those commits are safe.

GitHub has made lockfiles for workflow dependencies in GitHub Actions generally available on October 28, 2026, two weeks after a public preview. A committed actions.lock file makes runners execute recorded commits, including transitive dependencies such as those of composite actions, even when tags or branches move later. Adoption is incremental per workflow, managed through the gh actions-lock CLI extension, whose verification mode can serve as a CI staleness gate. Dependabot updates the matching lockfile entry in the same pull request, and admins can enforce a Require lockfile policy. GitHub notes that a lockfile guarantees which commits run but not that they are safe, so the review performed when entries are created or updated remains the key control. Competing platforms such as GitLab and Azure Pipelines have not announced a native equivalent, relying instead on manual SHA pinning and third-party tools.