GitHub ships gh-actions-lock to pin every Actions dependency to an exact commit
DanielLockyer · x · 2026-11-12
Amid ongoing supply-chain security incidents, the author recommends locking GitHub Actions workflows with GitHub's official CLI extension gh-actions-lock. It generates and verifies a dependency lockfile, pinning every action your workflows use to an exact commit — protecting against tag hijacking and upstream tampering.
Usage is two steps: gh extension install github/gh-actions-lock, then run gh actions-lock. MIT-licensed, 353 stars.
Related event: GitHub Releases gh-actions-lock to Pin Actions Dependencies(2 posts)→
More from coding & agent
- AWS Emulator Was Written 100% by Thousands of Autonomous AI Agents — dfinke · 2026-11-13
- AI Has Made Framework Switching Costs Lower Than Ever, Argues Frameworks Author — Vjeux · 2026-11-13
- NetBird routing peer lets you reach uncliented servers securely without opening ports — philipvollet · 2026-11-13
- Gemini's new Decision API tested: AI auto-orchestrates UI decision paths — huangyun_122 · 2026-11-13
- Asking an AI coding agent for a one-line install script, got a full cross-platform paragraph — gethackteam · 2026-11-13
- New Company Agent Bench compares Dots, Grok Bot, Claude Tag, Devin on company knowledge — philhchen · 2026-11-13