Repolode
Submit
github

github/gh-actions-lock

A GitHub CLI extension that pins every action used in your workflows to an exact commit and verifies the lockfile in CI.

View on GitHub
Stars
300
Forks
22
Open issues
33
Last commit
2 days ago

What is it?

gh-actions-lock is a GitHub CLI extension that generates and checks a lockfile for GitHub Actions dependencies. It resolves every direct and transitive action referenced in your workflows and records the exact commit each one resolves to in .github/workflows/actions.lock, so a moved tag or branch cannot silently change what your CI runs.

The tool offers several modes: a fix run that writes or updates the lockfile, a relock mode that advances floating refs such as main or v4 to their current upstream commits, a verify mode for CI that runs the same checks as a fix, and an offline verify-local mode for pre-commit hooks that confirms every uses: line has a lockfile entry. It supports github.com and GitHub Enterprise Cloud with data residency, but not GitHub Enterprise Server.

The project documents known limitations, including that reusable workflows called from other repositories and container images without digests are not locked, and that local ./ actions are not followed.

Key features

  • 01Pins direct and transitive GitHub Actions to exact commits in actions.lock.
  • 02Provides a verify mode for CI and an offline verify-local mode for pre-commit checks.
  • 03Can relock floating refs like main or v4 to current upstream commits.
  • 04Supports github.com and GitHub Enterprise Cloud with data residency.
  • 05Outputs machine-readable results with --json.

Use cases

  • Locking action versions in a repository so CI runs use reviewed commits.
  • Adding a lockfile verification step to pull request checks.
  • Running an offline coverage check before committing workflow changes.

Quick start

  1. 1

    Install the GitHub CLI extension

    gh extension install github/gh-actions-lock
  2. 2

    From your repository checkout, pin all actions and write the lockfile

    gh actions-lock
  3. 3

    Stage the workflow directory so the lockfile is checked into source

    git add .github/workflows/

Things to know

  • Requires an authenticated gh CLI.
  • GitHub Enterprise Server is not supported.
  • Reusable workflows called from another repository are not locked.
  • Container images without an @sha256 digest produce warnings and are not locked.

In collections

CLI & terminal toolsSecurity scanners, audits & threat intel tools

Topics

#github-actions#supply-chain-security#dependency-pinning#lockfile#cli#devops#gh-extension#go#security

FAQ

What is gh-actions-lock?
A GitHub CLI extension that pins every action used in your workflows to an exact commit and verifies the lockfile in CI. gh-actions-lock is a GitHub CLI extension that generates and checks a lockfile for GitHub Actions dependencies. It resolves every direct and transitive action referenced in your workflows and records the exact commit each one resolves to in .github/workflows/actions.lock, so a moved tag or branch cannot silently change what your CI runs.
Is gh-actions-lock free to use? What license does it have?
gh-actions-lock is open source under the MIT license. Check the license terms before using it in commercial products.
Is gh-actions-lock still maintained?
Actively maintained. The last commit to gh-actions-lock was on Nov 6, 2026.
What can I use gh-actions-lock for?
Locking action versions in a repository so CI runs use reviewed commits. Adding a lockfile verification step to pull request checks. Running an offline coverage check before committing workflow changes.
How do I install gh-actions-lock?
Install the GitHub CLI extension: gh extension install github/gh-actions-lock From your repository checkout, pin all actions and write the lockfile: gh actions-lock Stage the workflow directory so the lockfile is checked into source: git add .github/workflows/
Where can I get gh-actions-lock?
The source code and installation instructions are on GitHub: https://github.com/github/gh-actions-lock

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects