GitHub Actions Workflow Lockfiles: How Pinned Action Versions Prevent Supply-Chain Attacks in CI/CD Pipelines

Workflow lockfiles pin GitHub Actions to commit SHAs, creating immutable dependency graphs that block malicious updates from compromising build agents.