GitHub Actions Lockfiles Prevent Supply Chain Attacks

GitHub Actions now supports workflow lockfiles to prevent supply chain attacks. Previously, best practice required pinning actions to full commit SHAs instead of version tags, since tags can be reassigned to malicious code. Lockfiles provide a better approach: workflows reference semantic version tags while a generated lockfile records the exact commits those tags resolved to, preventing tag reassignment attacks without sacrificing readability.

Implementing lockfiles requires installing GitHub’s gh-actions-lock extension and running it to generate a .github/workflows/actions.lock file containing tag-to-commit mappings. Dependency updaters like Renovate and Dependabot already handle lockfile maintenance during routine updates. GitHub recommends adding a CI validation step to ensure the lockfile remains synchronized with workflow definitions. The zizmor security linter, which audits GitHub Actions configurations, added lockfile support in version 1.32.0.