What is GitHub Actions Workflow Lockfiles (actions.lock)?

Modern software is assembled from many outside parts, such as libraries, tools and automation steps, and together these form a software supply chain. That creates a risk: if one of those parts is quietly changed, everything built from it can inherit the change. GitHub Actions workflows reference reusable actions by names such as tags or branches, and these can move after a workflow was reviewed, so a later run might execute different code. A workflow dependency lockfile, kept at .github/workflows/actions.lock, records the exact commit for each action a workflow uses. A GitHub CLI extension called gh actions-lock generates it, and GitHub announced it as a public preview on October 14, 2026.

Written from primary sources and reference pages, and checked against them by an independent AI fact-checker. Drafted with AI assistance.