Lock your GitHub Actions

22 points by hugoarnal

nedbat

This helpfully shows me how to lock the actions, but I'm missing how it's better than the old way: SHAs in the references, updated by dependabot.

nedbat

I got an answer: this pins transitive dependencies also.
thiht

I migrated to a lock file because it doesn’t clutter the workflows with hashes, it’s cleaner with proper versions. It also works with Dependabot so no regression on this side either.
rtpg

yeah at work we use ratchet and it works quite well.
- lpil
  
  This only pins direct dependencies, all others are unpinned when using this approach.
bakkot

Seems good!

I wish they'd provided a way to do this without the gh tool; I can't be the only person who doesn't use it. Maybe I'm just missing it.