GitHub Actions Lockfiles are now in technical preview:
The GitHub community design discussion: https://github.com/orgs/community/discussions/194494
It provides true dependency tree pinning akin to package-lock.json. This is better that the previous hash-pinning which only pinned the immediate dependency, but not the nested, transient dependencies.
Renovate has added support for the lockfiles: renovatebot/renovate#45199
From renovatebot/renovate#45199:
gh actions-lock rewrites the workflows it manages back to plain refs
when it regenerates them, which strips out any inline digest pin
Hence, this necessarily replaces: #27
Workflow
Unlike prior art, this lockfile is used and enforced by GitHub Actions workers themselves without additional action calls.
Usage: https://github.com/github/gh-actions-lock/tree/f41c314f82c2382ef0263c8d93e6d66dce327456
GitHub Actions Lockfiles are now in technical preview:
gh actions pincli/cli#13314The GitHub community design discussion: https://github.com/orgs/community/discussions/194494
It provides true dependency tree pinning akin to
package-lock.json. This is better that the previous hash-pinning which only pinned the immediate dependency, but not the nested, transient dependencies.Renovate has added support for the lockfiles: renovatebot/renovate#45199
From renovatebot/renovate#45199:
Hence, this necessarily replaces: #27
Workflow
Unlike prior art, this lockfile is used and enforced by GitHub Actions workers themselves without additional action calls.
Usage: https://github.com/github/gh-actions-lock/tree/f41c314f82c2382ef0263c8d93e6d66dce327456