What Are GitHub Actions Lockfiles, and Do They Replace SHA Pinning?

Your SDK release workflow runs when someone pushes a version tag. Its steps read actions/checkout@v4,...