GitHub Actions Lockfiles Now Enforced to Mitigate Supply Chain Risks

• •GitHub Actions lockfiles are now generally available to enhance security.
• •The 'gh actions-lock' CLI extension allows users to pin actions to specific commits.
• •Repository administrators can enforce lockfile policies for consistent security.

GitHub has announced the general availability of workflow dependency lockfiles, allowing users to pin actions to specific commits to prevent supply chain attacks. This feature is now accessible across various GitHub plans including Enterprise Cloud and Team. Users can utilize the 'gh actions-lock' CLI extension to create and manage lockfiles, which ensure that workflows run vetted code. The lockfiles help maintain the integrity of workflows by preventing unexpected changes in dependencies. GitHub encourages repository administrators to enforce lockfile policies to enhance security. The implementation of lockfiles is crucial as it mitigates risks associated with mutable tags that can be redirected to malicious code. The feature is designed to provide consistent and auditable assurance for developers without requiring individual teams to adopt the practice independently. As of now, there are no reports of related to this feature.