Video · youtube.com
Understanding YAML for GitHub Actions and Running tests
Found in a YouTube search for how-to tutorials on this article's topic.
McGruff It
A GitHub Actions lockfile can freeze the exact third-party code your CI runs
McGruff's findings
Executive assessment
The article’s central claim is supported by GitHub’s October 14 announcement: an onboarded workflow runs commits recorded in `.github/workflows/actions.lock` even when its YAML retains a movable reference. Its low-risk pilot advice is sound, but it should qualify reusable-workflow coverage and note that generation may edit workflow YAML. This remains a public preview; GitHub’s extension README warns that its format and behavior may change. ([github.blog](github.blog)) Source URLs: ; github.com ; docs.github.com
Key discoveries
- GitHub’s CLI distinguishes read-only `--verify`, which makes network checks for CI, from offline `--verify-local`, which checks coverage but not provenance. ([github.com](https://github.com/github/gh-actions-lock))
- Boost Security Labs reports testing nested-action pinning and enforcement in its own CI. It also points out that a locked action can still download mutable binaries, packages, or container images at runtime. ([labs.boostsecurity.io](https://labs.boostsecurity.io/articles/pinning-the-unpinnable-github-actions-lockfiles/))
Practical takeaways
- Pilot one low-risk workflow, run `gh actions-lock` with that workflow’s path, and review and commit both the generated lockfile and any workflow-file changes. ([docs.github.com](https://docs.github.com/en/actions/how-tos/secure-your-work/lock-workflow-dependencies))
- For a pull-request check, use `gh actions-lock --verify`; do not treat the offline `--verify-local` coverage check as equivalent provenance verification. ([github.com](https://github.com/github/gh-actions-lock))
- Do not assume a caller’s lockfile pins a remote reusable workflow or the actions inside it. Check the extension’s stated limitation and manage the reusable workflow’s own dependencies in its defining repository. ([github.com](https://github.com/github/gh-actions-lock))
Conflicting evidence
- The article suggests comparing CI runs without changing workflow files. GitHub’s setup guide says generating a lockfile can also rewrite `uses` references to more specific versions and convert same-repository action references. Inspect the entire diff, not just `actions.lock`. ([docs.github.com](https://docs.github.com/en/actions/how-tos/secure-your-work/lock-workflow-dependencies))
- An October 15 independent test found a fork-commit validation bypass. GitHub reported a backend fix on October 16 and marked the related CLI issue completed on October 21. It is a useful preview-history caveat, not evidence that the reported backend bypass remains open. ([github.com](https://github.com/github/gh-actions-lock/issues/174))
Best Videos
Video · youtube.com
Github Actions CI/CD - Everything you need to know to get started
Found in a YouTube search for how-to tutorials on this article's topic.
Video · youtube.com
Complete GitHub Actions Course - From BEGINNER to PRO
Found in a YouTube search for how-to tutorials on this article's topic.
Video · youtube.com
GitHub Actions Explained: Everything You Need to Know
Found in a YouTube search for reviews, demonstrations, comparisons, or discussions of this article's topic.
Video · youtube.com
The GitHub Actions Model, and YAML Read Carefully
Found in a YouTube search for reviews, demonstrations, comparisons, or discussions of this article's topic.
Video · youtube.com
GitHub Actions Review 2026 – Powerful CI/CD Automation Inside GitHub
Found in a YouTube search for reviews, demonstrations, comparisons, or discussions of this article's topic.
Video · youtube.com
YAML Pipelines Walkthrough - GitHub Actions & Workflows
Found in a YouTube search for reviews, demonstrations, comparisons, or discussions of this article's topic.
Video · youtube.com
GitHub Actions or GitLab? Here's What You Need to Know
Found in a YouTube search for reviews, demonstrations, comparisons, or discussions of this article's topic.
Video · youtube.com
GitHub Actions for .NET Teams #1: Azure DevOps vs GitHub Actions — A YAML Rosetta Stone
Found in a YouTube search for reviews, demonstrations, comparisons, or discussions of this article's topic.
Video · youtube.com
GitHub Actions Runners Explained | When to Use Hosted vs Self-Hosted 2026
Found in a YouTube search for reviews, demonstrations, comparisons, or discussions of this article's topic.
Video · youtube.com
GitLab CI vs GitHub Actions | Quick Explainer
Found in a YouTube search for reviews, demonstrations, comparisons, or discussions of this article's topic.
Video · youtube.com
Github Actions (2/5): Use Cursor to create the Actions ci.yaml
Found in a YouTube Shorts search for this article's topic.
Tutorials & How-To
Tutorial · youtube.com
CI/CD Tutorial using GitHub Actions - Automated Testing & Automated Deployments
Found in a YouTube search for how-to tutorials on this article's topic.
Tutorial · youtube.com
How to use GitHub Actions | GitHub for Beginners
Found in a YouTube search for how-to tutorials on this article's topic.
Tutorial · youtube.com
GitHub Actions Tutorial - Basic Concepts and CI/CD Pipeline with Docker
Found in a YouTube search for how-to tutorials on this article's topic.
Tutorial · youtube.com
GitHub Actions YAML Tutorial #github #coding #developer #techtips
Found in a YouTube Shorts search for this article's topic.
Tutorial · youtube.com
GitHub Actions Tutorial | From Zero to Hero in 90 minutes (Environments, Secrets, Runners, etc)
Found in a YouTube search for reviews, demonstrations, comparisons, or discussions of this article's topic.
Tutorial · youtube.com
GitHub Actions Tutorial: Advanced Concepts You Should Know (Part 1)
Found in a YouTube search for reviews, demonstrations, comparisons, or discussions of this article's topic.
Reviews & Expert Analysis
Review · labs.boostsecurity.io
Pinning the Unpinnable: Taking GitHub Actions Lockfiles Apart
Hands-on migration and security tests, with discussion of what action locking does not freeze.
Independent testing rather than a restatement of the announcement.
Original Sources & Documentation
Documentation · docs.github.com
Locking action dependencies in a repository's workflows
Installation, single-workflow onboarding, diff review, and maintenance instructions.
Practical primary-source pilot procedure; flags possible YAML rewrites.
Code · github.com
github/gh-actions-lock
Extension source and current README with installation, modes, and limitations.
Most useful source for current CLI behavior and the remote-reusable-workflow gap.
Code · github.com
Full-SHA lock entries can accept a fork-only commit under the upstream action name
Bug report and maintainer updates on fork-only commit validation.
Tracks a reported preview defect and its subsequent fix status.
Reporting · github.blog
GitHub Actions workflow lockfiles in public preview - GitHub Changelog
This page was returned by web search for this article.
Documentation · docs.github.com
Workflow dependency lockfiles - GitHub Enterprise Cloud Docs
This page was returned by web search for this article.