Lock every CI action and its dependencies to a reviewed commit

How to do it

A tag such as v4 can point at new code tomorrow. A hijacked action then runs with the job's token and secrets. A commit hash in the workflow pins the action itself, but not the actions it calls. Where the code host offers a lock file for workflows, use it. GitHub keeps one at .github/workflows/actions.lock, written by the gh actions-lock extension, in public preview since October 2026. Its docs call the lock file the better option than hash pinning, because it covers those inner actions. Without a lock file, pin each uses: line to a full commit hash with the version in a comment. In GitLab CI, pin each include: to a commit with ref:. Let the update bot raise the locks after the release cooldown. Read an action's code before you first lock it, since a lock proves sameness, not safety. Run the verify step in the CI check.

Examples

Shell example

# GitHub: write the lock file once, then verify it in every CI run
gh extension install github/gh-actions-lock
gh actions-lock            # writes .github/workflows/actions.lock
gh actions-lock --verify   # changes nothing and fails when the lock is out of date

YAML example

# GitLab CI without a lock file: pin each include to a commit
include:
  - project: example/ci-templates
    ref: 9f2c4e1b7a3d5f60e8c1b2a4d6f8e0c2b4a6d8f0
    file: /node.yml

Shell example 2

# CI gate without a lock file: every uses: line names a full commit hash
if grep -rhoE 'uses: *[^ ./][^ ]*@[^ ]+' .github/workflows | grep -vE '@[0-9a-f]{40}$'; then
  echo "FAIL: action not pinned to a commit"; exit 1
fi

How to check

In CI, gh actions-lock --verify passes, or a search of the CI files finds 0 uses: lines and 0 include: entries without a 40-character commit hash. A pull request that changes a uses: line without its lock entry fails the check.

Sources

• GitHub workflow dependency lockfiles
• GitHub secure use reference

Related rules

• APS-72 Wait a few days before taking new releases in Application security
• ENG-16 Run the checks on every change in Engineering
• APS-74 Keep secrets out of builds from strangers in Application security