# GitHub Actions adds lockfiles to verify workflow dependencies

_Published Wednesday, November 11, 2026 at 6:05 PM EST · Security · Latest · Tier 2 — Notable_

![GitHub Actions adds lockfiles to verify workflow dependencies — Primary](https://hugovk.dev/blog/2026/lock-github-actions/feature.jpg)

GitHub Actions now supports workflow lockfiles, allowing workflows to use readable version tags while recording the underlying commits and repository identities, developer Hugo van Kemenade reports. Tags can be redirected to malicious code, which previously made full commit hashes the recommended way to pin dependencies.

The `gh-actions-lock` command generates an `actions.lock` file containing dependency references, commits, owner IDs and repository IDs. Renovate and Dependabot already support updating the file. GitHub also recommends verification in continuous integration to detect workflows that are out of sync or locked references that no longer verify upstream.

## Sources

- [hugovk.dev](https://hugovk.dev/blog/2026/lock-github-actions/)

---
Canonical: https://techandbusiness.org/newswire/fhMz2Ea4wcVgEA5mP6scR_
Published: 2026-11-11T23:05:29.882Z
Story chronology: 2026-11-11T12:19:08.000Z
Retrieved: 2026-11-12T01:04:38.402Z
Publisher: Tech & Business (techandbusiness.org)