Technology1 min read

Lock Your GitHub Actions

By · Published by Everything Blog

In short

The new workflow lockfiles enable repositories to reference clean version tags while storing exact commit SHAs and repository details in an "actions.lock" file. Developers can implement the functionality using the "gh-actions-lock" GitHub CLI extension to rewrite workflows and record their dependencies. The ecosystem is actively adopting the feature, with tools like Dependabot, Renovate, and the zizmor linter already providing integration and update support.

Key points

  • Using lockfiles resolves the supply-chain security risks associated with mutable Git vers…: Using lockfiles resolves the supply-chain security risks associated with mutable Git version tags without requiring manual hash management.
  • Automated dependency management tools like Renovate and Dependabot support these workflow…: Automated dependency management tools like Renovate and Dependabot support these workflow lockfiles to streamline routine version updates.
  • Running verification commands within continuous integration pipelines ensures that lockfi…: Running verification commands within continuous integration pipelines ensures that lockfiles remain synchronized, accurate, and completely uncorrupted over time.

Sources checked by our analysis pipeline: 1

Table of Contents

GitHub Actions now supports workflow lockfiles.

Because GitHub Actions are fetched from Git, the previous advice was to pin to a full SHA instead of a tag. This is because tags are mutable and susceptible to supply-chain attacks where an attacker points a previously safe tag at malicious code.

For example, an old workflow looks like:

name: Lint

on: [push, pull_request, workflow_dispatch]

permissions: {}

env:

FORCE_COLOR: 1

RUFF_OUTPUT_FORMAT: github

jobs:

lint:

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

persist-credentials: false

- uses: j178/prek-action@44924fe9ef4a6f88253c4b6b1bf11c689d3ce53d # v3.1.0

Here’s how I set up lockfiles.

Install #

Install the gh-actions-lock

extension to the gh

CLI:

$ gh extension install github/gh-actions-lock

✓ Installed extension github/gh-actions-lock

Lock ’em #

In your repo, run:

$ gh actions-lock

✓ All 1 workflows valid

The workflow now uses vX.Y.Z

tags and looks like this:

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml

index 946971c..3503607 100644

--- a/.github/workflows/lint.yml

+++ b/.github/workflows/lint.yml

@@ -13,7 +13,7 @@ jobs:

runs-on: ubuntu-latest

steps:

- - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

+ - uses: actions/checkout@v7.0.1

with:

persist-credentials: false

- - uses: j178/prek-action@44924fe9ef4a6f88253c4b6b1bf11c689d3ce53d # v3.1.0

+ -…

Technology

More in Technology