GitHub announced workflow dependency lockfiles on October 14. The problem they address is subtle: an action referenced by a tag can change after code review, meaning the next CI run executes different code.
The preview uses the gh actions-lock extension to generate .github/workflows/actions.lock with reviewable commits, including reusable workflows and transitive dependencies. Dependabot can update the lockfile when it updates an action.
The announcement and documentation describe eligible plans and a gradual onboarding path. Check the current repository setting before assuming it is available everywhere; this is still a preview.
A sensible test is a noncritical repository with two or three external actions. Generate the lockfile, inspect the exact commits and compare a before-and-after CI run without changing production workflows.
What to do: Check whether one low-risk GitHub Actions repository supports the preview; inspect a generated lockfile before enabling any enforcement policy.