Lock your GitHub Actions

nedbat | 14 hours ago

This helpfully shows me how to lock the actions, but I'm missing how it's better than the old way: SHAs in the references, updated by dependabot.

nedbat | 14 hours ago

I got an answer: this pins transitive dependencies also.

thiht | 13 hours ago

I migrated to a lock file because it doesn’t clutter the workflows with hashes, it’s cleaner with proper versions. It also works with Dependabot so no regression on this side either.

rtpg | 12 hours ago

yeah at work we use ratchet and it works quite well.

lpil | an hour ago

This only pins direct dependencies, all others are unpinned when using this approach.

bakkot | 9 hours ago

Seems good!

I wish they'd provided a way to do this without the gh tool; I can't be the only person who doesn't use it. Maybe I'm just missing it.