GitHub Actions Workflow Lockfile: Pin Transitive Deps
GitHub just made workflow lockfiles generally available, and the gh actions-lock command finally answers a question that SHA pinning never could: what about the actions your actions call? A GitHub Actions workflow lockfile records exact commits for actions and their transitive dependencies, while your YAML keeps its readable @v4 style references. That's the release. The harder part is rolling it…
GitHub has recently made workflow lockfiles available for use, which addresses the limitation of SHA pinning by recording exact commits for actions and their transitive dependencies. The lockfile complements the YAML by providing a more comprehensive record of the workflow. While the process of rolling out the lockfile may require careful consideration to avoid disrupting CI pipelines, it represents a significant improvement over previous methods of pinning only the top-level actions.
To implement the lockfile, it is recommended to start with low-risk workflows, such as a documentation build, and gradually expand to other workflows that hold sensitive deploy credentials. A Python script has been provided to audit the current uses: lines in the workflow files and classify them based on their pinning status. This audit can serve as a baseline before proceeding with the lockfile implementation.
Additionally, a guard job has been suggested to ensure that the uses: lines do not change without a corresponding update to the lockfile. This added safety measure helps prevent unintentional drift between the YAML and the lockfile.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
