Lock GitHub Actions

The new best practice

Lock your Actions with `actions.lock`

In October 2026 GitHub introduced workflow lockfiles. A lockfile records the exact commit of every Action a workflow uses, including the Actions those Actions use, while your workflows keep readable tags.

repositories have an actions.lock

0.3%

of the 6,523 repositories that use Actions

of those lock every workflow completely

Why locking replaces pinning

Pinning by SHA (the old answer)

uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

Immutable, but not human readable
SHA and comment may drift
Only covers the Actions you reference. A composite Action's own uses: stay mutable
Needs tooling for migration and updates

Locking (the new answer)

# workflow
uses: actions/checkout@v4

# .github/workflows/actions.lock
actions/checkout@v4: b4ffde65f4...

Readable workflows, finally! <3
Immutable resolution
Covers transitive dependencies
First class support in gh CLI

How to adopt it

1. Generate the lockfile

gh extension install github/gh-actions-lock
gh actions-lock

2. Keep it fresh

Both Renovate and Dependabot already have (experimental) support for action lockfiles and regenerate actions.lock in their update pull requests.

3. Verify in CI

gh actions-lock --verify-local

Then audit with zizmor (1.32+ reads the lockfile).

History

Pinning used to be the best practice

Since 2024 we track how many of the top 10,000 repositories pin their Actions by SHA. It is still a valid hardening step, but lockfiles are more powerful and user-friendly and recommended going forward.

Scan	PinnedFully pinned	Locked	PartialPartially	Unpinned	Uses Actions	Data

Beyond locking & pinning: zizmor findings

Pinning and locking fix one class of problem. We also ran zizmor, a GitHub Actions security analyzer, over every workflow. This uncovered 347,954 findings over the ~10,000 scanned repositories. Browse them per repository and rule.

Open the explorer →

Lock your Actions with actions.lock