Security & supply chainGitHub Actions lockfiles pin the commit and leave your tags alone
GitHub Actions workflow dependency lockfiles are in public preview. A GitHub CLI extension records the exact commits behind a workflow's actions, their transitive dependencies and reusable workflows, and onboarded runs use those commits even if a tag or branch moves.