GitHub Actions lockfiles pin workflow dependencies to reviewed commits
GitHub opened workflow dependency lockfiles to public preview. Workflows can keep readable tags or branches while execution uses locked commits for actions, transitive dependencies and reusable workflows; administrators can require lockfiles and Dependabot can update them.
Why it matters: A moved tag can silently change code with repository or cloud credentials. The preview makes the executed workflow dependency graph reviewable and reproducible without forcing opaque commit SHAs into every YAML reference.