Workflow dependency lockfiles

A lockfile is a crucial tool for ensuring the security and reliability of GitHub Actions workflows. By locking every action that a workflow depends on to a verified commit, the lockfile guarantees that the code executed during a workflow runs is the same code that was originally reviewed. This prevents malicious code from running if an upstream maintainer's account is compromised and a tag or branch is pointed elsewhere.

The lockfile works by pinning commit SHA to every action, including transitive dependencies, but does not control other build inputs like input parameters, secrets, or the runner image. To implement a lockfile, a repository needs to create a file named .github/workflows/actions.lock using the gh actions-lock GitHub CLI extension.

Once onboarded, the lockfile covers all workflows in the repository, including transitive dependencies, except for reusable workflow calls. A reusable workflow can have its own lockfile, which is defined and covered by the repository where it's defined. The lockfile is divided into two sections - workflows, which records the dependencies of each onboarded workflow, and dependencies, which records the commit each reference resolves to.

This structured format allows tools like Dependabot to manage dependency updates using machine-readable records, without needing YAML comments as version annotations. Adopting a lockfile is now the recommended way to pin third-party actions to a full-length commit SHA, surpassing the previous requirement for individual workflow file edits.