Lock Your GitHub Actions
GitHub Actions now supports workflow lockfiles, replacing the older advice of pinning actions to a full SHA to avoid mutable-tag supply-chain attacks. The post covers generating and committing actions.lock with the gh-actions-lock extension, Renovate and Dependabot support, verifying lockfiles in CI, and linting with zizmor.
What this means for indie developers：Indie developers running CI on GitHub Actions can cheaply reduce supply-chain risk from third-party actions with this setup.