GitHub Actions adds lockfiles to fight supply chain attacks

GitHub has introduced a new lockfile feature for Actions, a tool designed to prevent supply chain attacks. Previously, developers had to manually pin workflows to specific Git commit SHAs instead of using readable version tags, because tags can be maliciously changed after-the-fact. The new system lets you use friendly version tags like v7.0.1 while automatically generating a lockfile that secretly pins to the exact, immutable SHA behind the scenes.

For engineers, this means simpler, more readable workflow files without sacrificing security. The lockfile is automatically managed by a new command-line tool, and existing automation like Dependabot and Renovate already support it. This is a practical security upgrade that reduces a major attack surface for millions of repositories.