Skip to content
NewA calmer, faster ZeroHour
StoryToolsinfo

GitHub Actions lockfiles pin action tags to commits

1 source · 2 articlesFirst reported Updated ()
Merged summary · from the lead articleSummaries by Vani AI

gh-actions-lock records commit SHAs while workflows keep version tags; zizmor 1.32.0 is the first release that accepts lockfiles.

A November 11, 2026 blog post explains GitHub Actions workflow lockfiles as an alternative to hard-coding full commit SHAs. Mutable tags can be repointed at malicious code, so the lockfile stores the commit for each tagged action. The author installs github/gh-actions-lock, generates .github/workflows/actions.lock, and adds a CI job that runs gh actions-lock --verify. Renovate and Dependabot already update lockfiles; zizmor before v1.32.0 still tells users to hash-pin.

Key facts
  • Example lockfile format version is v0.0.3.
  • The verify job pins gh-actions-lock to v0.4.1.
  • actions/checkout@v7.0.1 and j178/prek-action@v3.1.0 are the sample pins.
  • The author runs the check on the ubuntu-slim runner.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Vendors
GitHub
Products
GitHub Actionsgh-actions-lockzizmorDependabotRenovate

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Hacker News · AIFirst report

    GitHub resolves outage hitting Actions, Copilot, Pages and Webhooks

    GitHub said the Actions job backlog was fully processed and that a detailed root-cause analysis is still to come.

  2. · 1d ago Hacker News · AI

    GitHub Actions lockfiles pin action tags to commits

    gh-actions-lock records commit SHAs while workflows keep version tags; zizmor 1.32.0 is the first release that accepts lockfiles.