# GitHub Actions workflow lockfiles in public preview

By Steven Van · 2026-10-14

Enterprise Cloud users can adopt locking one workflow at a time, with Dependabot keeping updated references and locked commits in sync.

Workflows can keep their tag and branch references while running the exact commits recorded in a lockfile. The feature is now in public preview for [GitHub](<https://creatorstoolbox.com/tools/github>) Enterprise Cloud and GitHub Enterprise Cloud with data residency.

## Lock dependencies workflow by workflow

The gh actions-lock extension for the GitHub CLI generates .github/workflows/actions.lock with reviewable commits for actions, their transitive dependencies and reusable workflow dependencies. To get started, install the extension, then review and commit the generated lockfile and workflow changes.

Workflows can be onboarded individually. Once onboarded, every dependency must have a lockfile entry, and GitHub Actions runs its recorded commit even if the tag or branch moves. The extension can also check whether the lockfile is up to date without modifying files, including in CI.

Locking protects against unexpected dependency changes, but does not establish whether a dependency is safe. Dependencies still need review before they are locked.

## Require lockfiles across workflows

The Require lockfile policy is also in public preview. Enterprise, organization and repository administrators can require workflows to use lockfiles across their respective scopes.

## Keep updates in sync with Dependabot

For an onboarded workflow, Dependabot regenerates the matching lockfile entry in the same pull request as an action version update. The workflow reference and locked commit stay in sync without additional configuration, as described in the [Dependabot documentation](<https://docs.github.com/code-security/concepts/supply-chain-security/dependabot-version-updates#updates-for-actions>).

![GitHub](<https://github.githubassets.com/assets/GitHub-Mark-ea2971cee799.png>)

GitHub

Where the world builds software — Git hosting, pull requests, issues, Actions CI/CD, and Copilot, free for public and private repos.

[View GitHub →](<https://creatorstoolbox.com/tools/github>)

[Original source](<https://github.blog/changelog/2026-10-14-github-actions-workflow-lockfiles-in-public-preview>)

[Read GitHub Actions workflow lockfiles in public preview on Creators Toolbox](<https://creatorstoolbox.com/blog/github-github-actions-workflow-lockfiles-in-public-preview>)

---
Canonical source: https://creatorstoolbox.com/blog/github-github-actions-workflow-lockfiles-in-public-preview