# Try github/gh-actions-lock — 15 October 2026

**Tested status:** Documentation reviewed; commands and Actions **not run**.

## Purpose, prerequisites and cost

Use the MIT-licensed [github/gh-actions-lock](https://github.com/github/gh-actions-lock) extension to pin GitHub Actions dependencies in a disposable personal repository. Requires GitHub CLI, Git and a personal GitHub account with a test repository containing a workflow. This is a technical preview; enforcement availability varies by plan/rollout. No model API, Gemini, purchase or upgrade required. Avoid Actions runs if your included minutes are insufficient.

## Commands

Run only from a disposable repository:

```sh
gh auth status
gh extension install github/gh-actions-lock
gh actions-lock
git status --short
git diff -- .github/workflows
gh actions-lock --verify
```

Inspect `.github/workflows/actions.lock`: compare each dependency's repository, reference and resolved commit. Do not commit changes until reviewed.

## Expected output

A lockfile listing the workflow dependencies and exact commit pins; verification succeeds when the lockfile matches the workflow. Exact messages vary by preview version.

## Troubleshooting

- Missing `gh`: install GitHub CLI.
- Authentication error: `gh auth login` using a **personal** account.
- Extension installation fails: check extension availability and network access.
- Verification fails: inspect stale/missing pins; review upstream changes before `gh actions-lock --relock`.
- Local-path actions may not be eligible for onboarding. Consult current project limitations.
- No runtime lockfile enforcement: report CLI inspection only, not guaranteed runtime pinning.

## Score (0–5)

One point each: extension installs; lockfile created; external dependencies represented; verification passes; reviewer checks upstream commits. Record failures and exact output.

**Evidence:** Documentation reviewed yes; CLI run no; lockfile generated no; Actions/model experiment no; runtime enforcement verified no.

Sources: [GitHub announcement](https://github.blog/changelog/2026-10-14-github-actions-workflow-lockfiles-in-public-preview/), [project README](https://github.com/github/gh-actions-lock), [MIT license](https://github.com/github/gh-actions-lock/blob/main/LICENSE).