GitHub Actions adds lockfiles to verify workflow dependencies

GitHub Actions now supports workflow lockfiles, allowing workflows to use readable version tags while recording the underlying commits and repository identities, developer Hugo van Kemenade reports. Tags can be redirected to malicious code, which previously made full commit hashes the recommended way to pin dependencies. The `gh-actions-lock` command generates an `actions.lock` file containing dependency references, commits, owner IDs and repository IDs. Renovate and Dependabot already support updating the file. GitHub also recommends verification in continuous integration to detect workflows that are out of sync or locked references that no longer verify upstream.