GitHub Ships gh-actions-lock to Pin Every Action to Verified Commits
DanielLockyer · x · 2026-11-12
Amid ongoing security incidents, GitHub's official gh-actions-lock CLI extension pins every direct and transitive action in your workflows to a verified commit, recorded in .github/workflows/actions.lock. Supports github.com and GHE Cloud with data residency (not GHES). Install with gh extension install github/gh-actions-lock, and gh skill install teaches your AI coding agent the CLI.
Related event: GitHub Releases gh-actions-lock to Pin Actions Dependencies(2 posts)→
More from coding & agent
- Creator shares Claude-powered video workflow: the model keeps learning and it compounds — floguo · 2026-11-12
- With just a webcam and minutes of calibration, Fable 5.2 builds a tool that tracks what you read — ChrisGPotts · 2026-11-12
- Profound CTO on Fractal Speed: a marketing harness cut two weeks to two hours — soleio · 2026-11-12
- 44 agent skills distilled from shipping 3 live products, open-sourced on GitHub — PawelHuryn · 2026-11-12
- GitHub's free Product Engineering skills walk you from idea to a deployed agentic product in 2-3 weeks — PawelHuryn · 2026-11-12
- Simular launches box, a dedicated computer built for running AI agents — _akhaliq · 2026-11-12