Hugo van Kemenade published a guide to GitHub Actions workflow lockfiles, which pin actions to verified commits while keeping readable version tags in workflow files. The post walks through installation, locking, CI validation, and tool support. Hugo van Kemenade published a guide for securing GitHub Actions with workflow lockfiles. GitHub Actions fetch code from Git repositories. Teams pinned actions to full commit SHAs because tags can change and point to malicious code.