Summary
On October 14, 2026, GitHub launched Actions workflow dependency lockfiles in public preview for Enterprise Cloud, letting teams pin a workflow's actions, transitive dependencies, and reusable workflows to exact commits via a .github/workflows/actions.lock file managed by a gh CLI extension.
What changed
Actions workflow lockfiles entered public preview: a .github/workflows/actions.lock records exact commits for actions, their transitive dependencies, and reusable workflows; it is maintained with the gh actions-lock CLI extension, enforceable via a 'Require lockfile' policy (also in preview), and auto-updated by Dependabot in the same pull request.
Why it matters
Pinning actions to immutable commits closes a long-standing supply-chain gap where a moved tag or branch could silently alter CI behavior, giving enterprises reproducible, tamper-resistant workflows without abandoning readable version references.
Evidence excerpt
Lockfiles let you keep those references in your workflow while running the exact commits you locked.