A GitHub Actions tag can move after you review it. GitHub’s new workflow lockfiles let you keep readable @v6 references while running the exact action commits you approved.
What’s new? On October 28, 2026, GitHub made workflow dependency lockfiles generally available on Free, Team, Enterprise Cloud, and Enterprise Cloud with data residency plans. The change is useful for anyone relying on third-party actions in CI. GitHub’s release announcement confirms the rollout.
Try it in an existing repository
You’ll need the GitHub CLI, an authenticated GitHub account, and repository write access. From your repository’s root directory, run these documented commands:
gh extension install github/gh-actions-lock
gh actions-lock .github/workflows/ci.yml
git diff -- .github/workflows/
gh actions-lock --verifyReplace ci.yml with your workflow filename. To onboard every workflow instead, run gh actions-lock without a path. Review the diff, then commit the generated .github/workflows/actions.lock and any workflow changes.
The extension records action references and their resolved commit hashes, including dependencies used by other actions. GitHub Actions executes those locked commits even if an upstream tag later moves. You don’t have to replace every readable action reference with a long SHA in your YAML.
How to keep the lockfile current
- Run
gh actions-lock --verifyin CI to catch stale or invalid locks without rewriting files. - Regenerate the lockfile when adding or changing action dependencies.
- For onboarded workflows, Dependabot updates matching lockfile entries when it proposes action version bumps.
- Consider GitHub’s Require lockfile policy after testing a small rollout.
Important limitations
This is not a malware scanner. A lockfile pins what you selected; it does not prove an action is trustworthy. Review changes before merging.
It also does not pin reusable workflows called with jobs.<job_id>.uses, container images, runner images, or secrets. Reusable workflows need their own full-SHA references or protection in their source repository. The official extension README says GitHub Enterprise Server is not supported.
Takeaway: Start with one CI workflow, inspect the generated lockfile, and add verification to pull requests. You get more predictable action code without turning every workflow into a wall of hashes.