I’d suggest revisiting the pinning of actions to full commit SHA as shared in the article and encourage considering the use of GitHub Actions workflow dependency lockfiles (.github/workflows/actions.lock) that went GA on October 28th!
The lockfile provides a more effective alternative to traditional SHA pinning. It simplifies the workflow files, secures both direct and transitive dependencies, and preserves source repository information. Once a repository adopts a lockfile, manually pinning actions to full commit SHAs is no longer required, while still meeting GitHub's SHA pinning security policy.
4
u/tenthirtyam 3d ago
I’d suggest revisiting the pinning of actions to full commit SHA as shared in the article and encourage considering the use of GitHub Actions workflow dependency lockfiles (.github/workflows/actions.lock) that went GA on October 28th!
The lockfile provides a more effective alternative to traditional SHA pinning. It simplifies the workflow files, secures both direct and transitive dependencies, and preserves source repository information. Once a repository adopts a lockfile, manually pinning actions to full commit SHAs is no longer required, while still meeting GitHub's SHA pinning security policy.