{"id":1483,"date":"2026-11-09T18:00:00","date_gmt":"2026-11-09T18:00:00","guid":{"rendered":"https:\/\/wade.one\/blog\/?p=1483"},"modified":"2026-11-09T18:00:00","modified_gmt":"2026-11-09T18:00:00","slug":"github-actions-dependencies-deserve-a-lockfile-too","status":"publish","type":"post","link":"https:\/\/wade.one\/blog\/2026\/11\/09\/github-actions-dependencies-deserve-a-lockfile-too\/","title":{"rendered":"GitHub Actions Dependencies Deserve a Lockfile Too"},"content":{"rendered":"<p>The dependencies in a CI workflow deserve the same attention as the packages in the application it builds. A short action reference can run code with access to the workspace and, depending on the job, credentials. I want changes to that code to be reviewable rather than arriving as an invisible consequence of a moved tag.<\/p>\n<p>GitHub&#8217;s <a href=\"https:\/\/docs.github.com\/en\/enterprise-cloud%40latest\/actions\/concepts\/security\/workflow-dependency-lockfiles\">workflow dependency lockfiles<\/a> record verified commits and repository identities. As checked on 26 October 2026, the feature is a public preview for GitHub Enterprise Cloud. It covers action dependencies, including transitive actions; reusable workflows have their own repository&#8217;s lockfile boundary. That scope is worth understanding before assuming one file locks everything everywhere.<\/p>\n<p>For repositories that cannot adopt it, GitHub&#8217;s <a href=\"https:\/\/docs.github.com\/en\/actions\/reference\/security\/secure-use\">secure-use guidance<\/a> still describes full-length commit SHA pinning. Neither option proves the selected code is safe. Review what you are selecting, limit the job&#8217;s permissions, and keep a deliberate update process so a stable reference does not become a permanently forgotten dependency.<\/p>\n<p>For me, the useful outcome is being able to answer which code ran and why it was allowed to change. A lockfile can make that answer easier to maintain. Treat the workflow as part of the software supply chain, then give its dependency updates the same clear review boundary as the rest of the application.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The dependencies in a CI workflow deserve the same attention as the packages in the application it builds.<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[13],"tags":[321,320,319],"class_list":["post-1483","post","type-post","status-publish","format-standard","hentry","category-programming","tag-ci-security","tag-dependency-lockfiles","tag-github-actions"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>GitHub Actions Dependencies Deserve a Lockfile Too - wade.one<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/wade.one\/blog\/2026\/11\/09\/github-actions-dependencies-deserve-a-lockfile-too\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GitHub Actions Dependencies Deserve a Lockfile Too - wade.one\" \/>\n<meta property=\"og:description\" content=\"The dependencies in a CI workflow deserve the same attention as the packages in the application it builds.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/wade.one\/blog\/2026\/11\/09\/github-actions-dependencies-deserve-a-lockfile-too\/\" \/>\n<meta property=\"og:site_name\" content=\"wade.one\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-09T18:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/Wade-Logo-cropped.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1518\" \/>\n\t<meta property=\"og:image:height\" content=\"1506\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@wadewomersley\" \/>\n<meta name=\"twitter:site\" content=\"@wadewomersley\" \/>\n<meta name=\"twitter:label1\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/11\\\/09\\\/github-actions-dependencies-deserve-a-lockfile-too\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/11\\\/09\\\/github-actions-dependencies-deserve-a-lockfile-too\\\/\"},\"author\":{\"name\":\"\",\"@id\":\"\"},\"headline\":\"GitHub Actions Dependencies Deserve a Lockfile Too\",\"datePublished\":\"2026-11-09T18:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/11\\\/09\\\/github-actions-dependencies-deserve-a-lockfile-too\\\/\"},\"wordCount\":222,\"publisher\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#\\\/schema\\\/person\\\/8b4739f8f8bb2cff5d792d4b8779fcc3\"},\"keywords\":[\"ci-security\",\"dependency-lockfiles\",\"github-actions\"],\"articleSection\":[\"Programming\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/11\\\/09\\\/github-actions-dependencies-deserve-a-lockfile-too\\\/\",\"url\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/11\\\/09\\\/github-actions-dependencies-deserve-a-lockfile-too\\\/\",\"name\":\"GitHub Actions Dependencies Deserve a Lockfile Too - wade.one\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#website\"},\"datePublished\":\"2026-11-09T18:00:00+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/11\\\/09\\\/github-actions-dependencies-deserve-a-lockfile-too\\\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/11\\\/09\\\/github-actions-dependencies-deserve-a-lockfile-too\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/11\\\/09\\\/github-actions-dependencies-deserve-a-lockfile-too\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/wade.one\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GitHub Actions Dependencies Deserve a Lockfile Too\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/wade.one\\\/blog\\\/\",\"name\":\"wade.one\",\"description\":\"wade womersley - york based software engineer\",\"publisher\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#\\\/schema\\\/person\\\/8b4739f8f8bb2cff5d792d4b8779fcc3\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/wade.one\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#\\\/schema\\\/person\\\/8b4739f8f8bb2cff5d792d4b8779fcc3\",\"name\":\"Wade Womersley\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/02\\\/200px.png\",\"url\":\"https:\\\/\\\/wade.one\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/02\\\/200px.png\",\"contentUrl\":\"https:\\\/\\\/wade.one\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/02\\\/200px.png\",\"width\":202,\"height\":200,\"caption\":\"Wade Womersley\"},\"logo\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/02\\\/200px.png\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"GitHub Actions Dependencies Deserve a Lockfile Too - wade.one","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/wade.one\/blog\/2026\/11\/09\/github-actions-dependencies-deserve-a-lockfile-too\/","og_locale":"en_GB","og_type":"article","og_title":"GitHub Actions Dependencies Deserve a Lockfile Too - wade.one","og_description":"The dependencies in a CI workflow deserve the same attention as the packages in the application it builds.","og_url":"https:\/\/wade.one\/blog\/2026\/11\/09\/github-actions-dependencies-deserve-a-lockfile-too\/","og_site_name":"wade.one","article_published_time":"2026-11-09T18:00:00+00:00","og_image":[{"width":1518,"height":1506,"url":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/Wade-Logo-cropped.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_creator":"@wadewomersley","twitter_site":"@wadewomersley","twitter_misc":{"Estimated reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/wade.one\/blog\/2026\/11\/09\/github-actions-dependencies-deserve-a-lockfile-too\/#article","isPartOf":{"@id":"https:\/\/wade.one\/blog\/2026\/11\/09\/github-actions-dependencies-deserve-a-lockfile-too\/"},"author":{"name":"","@id":""},"headline":"GitHub Actions Dependencies Deserve a Lockfile Too","datePublished":"2026-11-09T18:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/wade.one\/blog\/2026\/11\/09\/github-actions-dependencies-deserve-a-lockfile-too\/"},"wordCount":222,"publisher":{"@id":"https:\/\/wade.one\/blog\/#\/schema\/person\/8b4739f8f8bb2cff5d792d4b8779fcc3"},"keywords":["ci-security","dependency-lockfiles","github-actions"],"articleSection":["Programming"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/wade.one\/blog\/2026\/11\/09\/github-actions-dependencies-deserve-a-lockfile-too\/","url":"https:\/\/wade.one\/blog\/2026\/11\/09\/github-actions-dependencies-deserve-a-lockfile-too\/","name":"GitHub Actions Dependencies Deserve a Lockfile Too - wade.one","isPartOf":{"@id":"https:\/\/wade.one\/blog\/#website"},"datePublished":"2026-11-09T18:00:00+00:00","breadcrumb":{"@id":"https:\/\/wade.one\/blog\/2026\/11\/09\/github-actions-dependencies-deserve-a-lockfile-too\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/wade.one\/blog\/2026\/11\/09\/github-actions-dependencies-deserve-a-lockfile-too\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/wade.one\/blog\/2026\/11\/09\/github-actions-dependencies-deserve-a-lockfile-too\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/wade.one\/blog\/"},{"@type":"ListItem","position":2,"name":"GitHub Actions Dependencies Deserve a Lockfile Too"}]},{"@type":"WebSite","@id":"https:\/\/wade.one\/blog\/#website","url":"https:\/\/wade.one\/blog\/","name":"wade.one","description":"wade womersley - york based software engineer","publisher":{"@id":"https:\/\/wade.one\/blog\/#\/schema\/person\/8b4739f8f8bb2cff5d792d4b8779fcc3"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/wade.one\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":["Person","Organization"],"@id":"https:\/\/wade.one\/blog\/#\/schema\/person\/8b4739f8f8bb2cff5d792d4b8779fcc3","name":"Wade Womersley","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/200px.png","url":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/200px.png","contentUrl":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/200px.png","width":202,"height":200,"caption":"Wade Womersley"},"logo":{"@id":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/200px.png"}}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":1329,"url":"https:\/\/wade.one\/blog\/2026\/06\/02\/github-copilot-coding-agent-needs-workflow-rules-not-just-access\/","url_meta":{"origin":1483,"position":0},"title":"GitHub Copilot Coding Agent Needs Workflow Rules, Not Just Access","author":"Wade","date":"June 2, 2026","format":false,"excerpt":"GitHub Copilot's coding agent is useful, but I would want explicit workflow rules around permissions, networking, and review before giving it real access.","rel":"","context":"In &quot;AI&quot;","block_context":{"text":"AI","link":"https:\/\/wade.one\/blog\/category\/ai\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1375,"url":"https:\/\/wade.one\/blog\/2026\/07\/14\/github-models-is-shutting-down-on-july-30\/","url_meta":{"origin":1483,"position":1},"title":"GitHub Models Is Shutting Down on July 30","author":"Wade","date":"July 14, 2026","format":false,"excerpt":"GitHub Models closes on July 30, with brownouts first, so this is a migration deadline rather than a product update to read later.","rel":"","context":"In &quot;Software Engineer&quot;","block_context":{"text":"Software Engineer","link":"https:\/\/wade.one\/blog\/category\/software-engineer\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1303,"url":"https:\/\/wade.one\/blog\/2026\/05\/15\/github-agent-hq-makes-ai-coding-a-platform-choice\/","url_meta":{"origin":1483,"position":2},"title":"GitHub Agent HQ Makes AI Coding a Platform Choice","author":"","date":"May 15, 2026","format":false,"excerpt":"GitHub adding Claude and Codex agent choices is a sign that AI coding is becoming a platform layer, not just a model picker.","rel":"","context":"In &quot;AI&quot;","block_context":{"text":"AI","link":"https:\/\/wade.one\/blog\/category\/ai\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1237,"url":"https:\/\/wade.one\/blog\/2026\/04\/26\/ai-code-review-should-reduce-noise-not-add-more-comments\/","url_meta":{"origin":1483,"position":3},"title":"AI Code Review Should Reduce Noise, Not Add More Comments","author":"","date":"April 26, 2026","format":false,"excerpt":"The best use of AI in code review is not adding more comments. It is finding the few things that actually matter.","rel":"","context":"In &quot;AI&quot;","block_context":{"text":"AI","link":"https:\/\/wade.one\/blog\/category\/ai\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1395,"url":"https:\/\/wade.one\/blog\/2026\/08\/16\/github-copilot-usage-metrics-are-becoming-cost-accounting\/","url_meta":{"origin":1483,"position":4},"title":"GitHub Copilot Usage Metrics Are Becoming Cost Accounting","author":"","date":"August 16, 2026","format":false,"excerpt":"Copilot's expanded app metrics are useful, but teams should measure outcomes and cost rather than celebrate activity alone.","rel":"","context":"In &quot;Software Engineer&quot;","block_context":{"text":"Software Engineer","link":"https:\/\/wade.one\/blog\/category\/software-engineer\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1393,"url":"https:\/\/wade.one\/blog\/2026\/08\/14\/ai-coding-tools-need-the-same-policy-everywhere\/","url_meta":{"origin":1483,"position":5},"title":"AI Coding Tools Need the Same Policy Everywhere","author":"","date":"August 14, 2026","format":false,"excerpt":"Coding-agent governance only works when the same rules follow developers across every client and cloud task.","rel":"","context":"In &quot;Software Engineer&quot;","block_context":{"text":"Software Engineer","link":"https:\/\/wade.one\/blog\/category\/software-engineer\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/posts\/1483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/comments?post=1483"}],"version-history":[{"count":1,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/posts\/1483\/revisions"}],"predecessor-version":[{"id":1497,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/posts\/1483\/revisions\/1497"}],"wp:attachment":[{"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/media?parent=1483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/categories?post=1483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/tags?post=1483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}