TLDR Tech / Launches
GitHub Actions lockfiles now pin commits, preserve tag readability
GitHub has launched a public preview for workflow dependency lockfiles in GitHub Actions. This feature allows developers to fix actions and their indirect dependencies to specific, verified commits while keeping tag references in YAML files easy to read. Generating a lockfile requires a GitHub CLI extension, and the system supports an administrative policy for mandatory lockfiles. Dependabot is also integrated to automatically update locked commits during version upgrades.
Read the full story