gh-actions-lock

GitHub CLI extension that pins every GitHub Actions dependency to a commit

Pluginfree

gh-actions-lock is a free, open-source gh CLI extension built by GitHub that generates a lockfile pinning every GitHub Actions workflow dependency to a verified commit, preventing an action from silently changing to a different or compromised version later. It's aimed at engineering and security teams who want to close a known supply-chain attack surface in their CI workflows.

Website

Full match profile

Behind the summary, Matchbox keeps a richer profile of gh-actions-lock - the signals our matcher actually reads to decide when to surface it. It stays private; claim the listing to see and control it.

Problem & pain-point mapping
Who we surface it to (audience fit)
What it's a strong alternative to
Trust & credibility signals

Claim gh-actions-lock to unlock →

Something wrong with this listing — dead link, not a real product, wrong info?

Try Matchbox with your own problem

Describe what is not working - we’ll show you whether gh-actions-lock (or something else) actually fits.

Try a problem