Skip to content

Lock workflow action dependencies with actions.lock - #10

Open
rgarcia wants to merge 1 commit into
mainfrom
hypeship/actions-lockfile
Open

rgarcia wants to merge 1 commit into
mainfrom
hypeship/actions-lockfile

Conversation

@rgarcia

@rgarcia rgarcia commented Nov 13, 2026

Copy link
Copy Markdown

Adds GitHub's workflow dependency lockfile. .github/workflows/actions.lock records the commit behind every action the workflows use, so a moved tag on a third-party action can't change what runs in CI.

  • Added .github/workflows/actions.lock, generated with gh actions-lock. gh actions-lock --verify passes for every workflow.
  • Floating refs narrowed to exact releases: actions/checkout@v4/@v5 → v4.4.0/v5.1.0, actions/setup-node@v4/@v5 → v4.4.0/v5.0.0. Each exact tag is the same commit the floating tag points to today, so nothing that runs changes. Only uses: lines change.
  • Not covered: nothing. These workflows don't call any reusable workflows.

@rgarcia
rgarcia requested a review from masnwilliams November 13, 2026 21:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant