Workflow dependency lockfiles

GitHub has documented workflow dependency lockfiles for Actions. The gh actions-lock CLI extension writes .github/workflows/actions.lock, which pins every direct and transitive action to a commit, recording the source repository's owner and repo IDs so runs can detect a swapped repository. Locked commits must remain reachable from the recorded tag or branch. Reusable workflow calls are not pinned and still need full SHAs, and inputs, secrets and runner images are outside its scope. GitHub Enterprise Server is unsupported. Most claims come from GitHub's own documentation alone.