GitHub Actions 工作流依赖锁定文件进入公开预览

GitHub Actions 工作流依赖锁定文件现已面向 GitHub Enterprise Cloud、具备数据驻留功能的 GitHub Enterprise Cloud、Team 和 Free 计划开放公开预览。标签和分支可能会在你审核工作流后发生移动，因此后续运行可能执行不同的代码。锁定文件让你能够在工作流中保留这些引用，同时运行你所锁定的确切提交。

编者注（2026 年 10 月 14 日）：已更新可访问此公开预览的计划范围。

如果某个 Action 遭到入侵，发生移动的标签或分支可能会在不更改你的仓库的情况下，将恶意代码引入工作流。锁定文件通过使工作流运行始终关联到你锁定的提交，帮助防范意外的依赖变更。锁定并不能判断依赖本身是否安全，因此请在锁定依赖前对其进行审核。

安装适用于 GitHub CLI 的 gh actions-lock 扩展，以创建和维护工作流锁定文件。使用该扩展，你可以：

• **固定依赖：**生成 .github/workflows/actions.lock，其中包含可供审核的 Actions 及其传递依赖的提交，以及可复用工作流依赖。
• **逐步采用锁定机制：**可逐个接入工作流。工作流接入后，其依赖必须具有锁定文件条目，GitHub Actions 将运行其中记录的提交。
• **保持工作流运行一致：**GitHub Actions 要求已接入工作流的每项依赖都存在于锁定文件中，并使用其记录的提交，即使标签或分支发生移动也是如此。
• **检查过期的锁定文件：**验证锁定文件是否为最新状态，且不修改文件；这也可用于 CI 检查。

Require lockfile 策略也已进入公开预览。企业、组织和仓库管理员可以要求其企业、组织或仓库范围内的工作流使用锁定文件。

Dependabot 可帮助你保持 GitHub Actions 依赖为最新版本。当它为已接入的工作流中的某个 Action 创建版本更新时，还会在同一个拉取请求中重新生成匹配的锁定文件条目，无需额外配置即可让更新后的工作流引用与其锁定提交保持同步。详见 Dependabot 对 Actions 的更新。

要开始使用，请从公开的 gh-actions-lock 仓库安装该扩展，然后审核并提交生成的锁定文件和工作流变更。

有关更多详细信息和设置说明链接，请参阅 GitHub Docs 中的工作流依赖锁定文件。

请在现有社区讨论中分享反馈，或在 gh-actions-lock 仓库中提交 issue。

感谢通过测试和反馈帮助塑造此次预览的社区成员。特别感谢 Andrew Nesbitt、François Proulx、Jesse Houwing 和 William Woodruff，感谢他们在过去一年中与我们紧密协作并持续迭代这一解决方案。

GitHub Actions workflow dependency lockfiles are now in public preview for GitHub Enterprise Cloud, GitHub Enterprise Cloud with data residency, Team, and Free plans. Tags and branches can move after you review a workflow, so a later run might execute different code. Lockfiles let you keep those references in your workflow while running the exact commits you locked.

Editor’s note (October 14th, 2026): Updated which plans have access to this public preview.

If an action is compromised, a moved tag or branch can introduce malicious code into your workflow without a change to your repository. Lockfiles help protect against unexpected dependency changes by keeping workflow runs tied to the commits you locked. Locking does not determine whether the dependency itself is safe, so review dependencies before locking them.

Install the gh actions-lock extension for the GitHub CLI to create and maintain your workflow lockfile. With the extension, you can:

• Pin your dependencies: Generate .github/workflows/actions.lock with reviewable commits for actions and their transitive dependencies, as well as reusable workflow dependencies.
• Adopt locking gradually: Onboard workflows individually. Once onboarded, a workflow must have lockfile entries for its dependencies, and GitHub Actions runs the recorded commits.
• Keep workflow runs consistent: GitHub Actions requires each dependency of an onboarded workflow to be in the lockfile and uses its recorded commit, even if a tag or branch moves.
• Check for stale lockfiles: Verify that the lockfile is up to date without modifying files, including in a CI check.

The Require lockfile policy is also available in public preview. Enterprise, organization, and repository administrators can require workflows to use lockfiles across their enterprise, organization, or repository.

Dependabot helps you keep your GitHub Actions dependencies up to date. When it opens a version update for an action in a workflow that is already onboarded, it also regenerates the matching lockfile entry in the same pull request, keeping the updated workflow reference and its locked commit in sync without additional configuration. Read more about Dependabot updates for actions.

To get started, install the extension from the public gh-actions-lock repository, then review and commit the generated lockfile and workflow changes.

For more details and links to setup instructions, see workflow dependency lockfiles in GitHub Docs.

Share feedback in the existing community discussion or open an issue in the gh-actions-lock repository.

Thank you to the community members who helped shape this preview through testing and feedback, with special thanks to Andrew Nesbitt, François Proulx, Jesse Houwing, and William Woodruff for their close collaboration and iteration on this solution over the past year.