GitHub Actions adds workflow lockfiles to block CI/CD supply-chain attacks

GitHub Actions introduced workflow lockfiles that pin actions to specific commit SHAs instead of mutable tags, blocking tag-swap and maintainer-compromise attacks. The feature entered public preview in October 2026 for Enterprise Cloud, Team, and Free plans.

• Lockfile at .github/workflows/actions.lock records a commit SHA for each action
• Require lockfile policy can be enforced at enterprise, org, or repo level
• Dependabot updates lockfiles automatically, cutting manual review overhead
• A deleted or force-pushed commit causes a hard workflow failure with no tag fallback