ChatLaw 官方最新动态：GitHub Actions workflow lockfiles in public preview

来源：ChatLaw 官方动态 | 发布日期：2026-10-14

核心更新概览

GitHub Actions workflow dependency lockfiles are now in public preview for GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency. Tags and branches can move after you review a workfl

详细内容记录

GitHub Actions workflow dependency lockfiles are now in public preview for GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency. Tags and branches can move after you review a workflow, so a later run might execute different code. Lockfiles let you keep those references in your workflow while running the exact commits you locked. If an action is compromised, a moved tag or branch can introduce malicious code into your workflow without a change to your repository. Lockfiles help protect against unexpected dependency changes by keeping workflow runs tied to the commits you locked. Locking does not determine whether the dependency itself is safe, so review dependencies before locking them. extension for the GitHub CLI to create and maintain your workflow lockfile. With the extension, you can: with reviewable commits for actions and their transitive dependencies, as well as reusable workflow dependencies. Onboard workflows individually. Once onboarded, a workflow must have lockfile entries for its dependencies, and GitHub Actions runs the recorded commits. GitHub Actions requires each dependency of an onboarded workflow to be in the lockfile and uses its recorded commit, even if a tag or branch moves. Verify that the lockfile is up to date without modifying files, including in a CI check. policy is also available in public preview. Enterprise, organization, and repository administrators can require workflows to use lockfiles across their enterprise, organization, or repository.

更多技术细节可访问官方原文：https://github.blog/changelog/2026-10-14-github-actions-workflow-lockfiles-in-public-preview。