GitHub Actions

GitHub has made workflow dependency lockfiles generally available for GitHub Actions, with runners executing the commit hashes recorded in actions.lock regardless of later tag or branch changes. The mechanism pins both direct and transitive dependencies, backed by the gh actions-lock CLI extension, Dependabot synchronization and an admin-enforced Require lockfile policy, closing gaps left by manual SHA pinning.

GitHub Actions has made workflow lockfiles generally available, offering a managed alternative to manually pinning actions to full commit SHAs to defend against mutable-tag supply chain attacks. The author walks through installing the gh-actions-lock CLI extension and generating lockfiles. The feature lowers the maintenance burden of securing CI/CD pipelines and is immediately actionable for developers relying on GitHub Actions.

GitHub suffered a multi-product availability degradation on November 12, 2026, affecting Webhooks, Actions, Pages and Copilot products. The official status page issued a series of updates confirming an ongoing investigation, with no root cause or recovery timeline disclosed. For teams relying on GitHub CI/CD and the Copilot coding assistant, the incident directly disrupts delivery pipelines.