GitHub Actions lockfile: pin your workflows safely

The GitHub Actions lockfile is generally available: pin actions and their dependencies to commits, verify it in CI and roll it out across your team.