GitHub Actions
GitHub's Actions Lockfile Skips the Docker Image
On 14 October GitHub put workflow dependency lockfiles into public preview: gh actions-lock writes .github/workflows/actions.lock, every action in an onboarded workflow runs at the recorded commit, and a Require lockfile policy can block anything else. The lock stops at the container: a Docker action's image is named in its own manifest and pulled by tag at job start, the extension warns only for a docker:// step written directly in your workflow and only on an online run, and a launch-day scan of 1,802 repositories found a silently floating image behind a locked action in 9.8% of them, 21.2% counting unpinned Dockerfile base images. By Friday the tracker also held unlocked reusable workflow calls, actions inside parallel: groups left out, and a fork-only commit that passed --verify and ran under the policy; my own offline run of the documented pre-commit check reported complete coverage over all of it.
Marco Kotrotsos·7 Nov 2026·10 min read
