GitHub Actions Workflow Lockfiles Enter Public Preview
GitHub has announced the public preview of workflow dependency lockfiles for GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency, helping teams protect against unexpected dependency changes.
Radwan AbdulhadiEditor and technology writer
Introduction to Workflow Lockfiles
GitHub has officially launched the public preview of workflow dependency lockfiles for GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency, according to the [GitHub Changelog](https://github.blog/changelog/2026-10-14-github-actions-workflow-lockfiles-in-public-preview/). Because tags and branches can move after a workflow has been reviewed, a later run might inadvertently execute different code. Lockfiles allow development teams to keep these references in their workflows while consistently running the exact commits they have locked.
If an action becomes compromised, a moved tag or branch can potentially introduce malicious code into a workflow without requiring any change to the repository. While lockfiles protect against unexpected dependency alterations by tying runs to specific commits, locking itself does not determine whether the underlying dependency is inherently safe, meaning users must still review dependencies prior to locking them.
Using the GitHub CLI Extension
To create and maintain workflow lockfiles, administrators and developers can install the dedicated extension for the GitHub CLI. Getting started requires reviewing the public [gh-actions-lock repository](https://github.com/github/gh-actions-lock) to install the extension, followed by reviewing and committing the generated lockfile alongside any necessary workflow changes.
The extension provides several capabilities for managing dependencies. Users can pin dependencies by generating a file with reviewable commits for actions, their transitive dependencies, and reusable workflow dependencies. Teams can also adopt locking gradually by onboarding workflows individually. Once a workflow is onboarded, GitHub Actions requires every dependency to have a lockfile entry and executes the recorded commit even if a source tag or branch moves. Furthermore, teams can verify that lockfiles remain up to date without modifying files, including running checks directly in CI environments.
Policies and Dependabot Integration
Alongside the lockfiles preview, the Require lockfile policy has also been introduced in public preview. Enterprise, organization, and repository administrators can leverage this policy to enforce the use of lockfiles across their entire enterprise, organization, or specific repositories.
To streamline maintenance, integration with Dependabot helps keep GitHub Actions dependencies current. When Dependabot opens a version update for an action in an already onboarded workflow, it simultaneously regenerates the matching lockfile entry inside the exact same pull request. This synchronization maintains the updated workflow reference and its locked commit without demanding extra configuration from developers. More information is available regarding [Dependabot updates for actions](https://docs.github.com/code-security/concepts/supply-chain-security/dependabot-version-updates#updates-for-actions).
Community Feedback and Documentation
Comprehensive technical details and setup instructions are documented under [workflow dependency lockfiles](https://docs.github.com/actions/concepts/security/workflow-dependency-lockfiles) in the official GitHub Docs. Developers who wish to share feedback can participate in the [existing community discussion](https://github.org/orgs/community/discussions/194494) or [open an issue in the gh-actions-lock repository](https://github.com/github/gh-actions-lock/issues) to report bugs or suggest enhancements.
GitHub expressed gratitude to community members who contributed to shaping this preview through rigorous testing and feedback. Special recognition was given to Andrew Nesbitt, François Proulx, Jesse Houwing, and William Woodruff for their collaborative efforts over the past year.
Sources
- GitHub ChangelogGitHub Actions workflow lockfiles in public preview
Continue chronologically
Related entity coverage
Related stories
GitHub Enterprise Cloud Launches License Compliance
Open source license compliance is now generally available for GitHub Enterprise Cloud, bringing ruleset-based dependency checks at scale.
GitHub Introduces Repository Custom Runner Settings for Dependabot
Repository administrators can now configure runner types, custom labels, and runner groups for Dependabot version and security updates.
GitHub Actions to Block pull_request_target by Default
GitHub Actions will block pull_request_target events by default in public repositories starting December 2, 2026, enhancing security.
GitHub Actions API and UI Updates Query Count Results
GitHub has introduced updates to query results in the GitHub Actions API and UI to improve performance and provide more accurate record counts.
