GitHub Actions in 2026. Lockfiles and safer runs

A workflow can execute different code after a tag moves even though your repository has not changed. An Actions review should establish what actually runs and which credentials that run can access.

GitHub's Actions security roadmap covers dependency locking, policy and network controls. A roadmap is not proof that every feature is available. Separate controls you can configure now from capabilities whose current status needs checking.

Lock reviewed versions

A tag such as actions/checkout@v4 may move. A commit SHA holds a direct dependency to a chosen revision. It does not establish that the code in that revision is safe.

GitHub announced workflow lockfiles in public preview on 14 October 2026. The gh actions-lock extension creates .github/workflows/actions.lock, including transitive action dependencies and reusable workflows. Onboarded workflows use the recorded commits even when a tag changes.

This is more than replacing each uses: reference with a SHA. Check plan availability and review lockfile updates alongside dependency changes.

Treat network control as another layer

The roadmap describes a firewall outside the runner VM. Its aim is to constrain outbound access even after compromise inside the VM. Before adopting it, confirm current availability and distinguish monitoring from enforcement.

An allowed destination is not proof that the traffic is safe. Malicious code may abuse an approved service or alter a build without any outbound request. Network policy complements dependency review and limited credentials.

Give policy and telemetry an owner

Decide who may modify workflows and trigger production releases. Grant tokens only the permissions the job needs and require approval for sensitive operations.

Telemetry should help reconstruct processes and connections after an incident. Establish who handles alerts and how long records must be kept. Verify current export capabilities rather than designing around an unshipped feature.

Start with the workflow you already run

Review dependency provenance, available secrets and job permissions against GitHub's security guidance. Repository popularity alone is not a security assessment.

The build also supplies code that runs in a browser, covered in our client-side security article. Regulated teams can also use the NIS2 preparation overview. To inspect a specific workflow together, contact us.