GitHub Actions workflow lockfiles enter public preview
GitHub announced that GitHub Actions workflow dependency lockfiles are now in public preview for GitHub Enterprise Cloud (including data residency), Team, and Free plans. The source excerpt indicates the feature addresses the fact that action tags and branches can change after a workflow is written.
Why it matters
Workflows that reference actions by mutable tags or branches can pick up unreviewed changes. Lockfiles pin dependency versions so workflow runs use a fixed, reviewable set of action references, which helps reproducibility and supply-chain security for CI/CD pipelines.
Who should care
Engineering teams and solo developers running GitHub Actions for deployments, builds, or automation; DevOps and security teams managing CI/CD supply-chain risk.
What you can do
Review the GitHub Actions lockfile documentation and test it in a non-production repository on a plan that has access to the public preview.