Securing GitHub Actions with Automated Lockfiles
Prevent supply-chain attacks by implementing automated lockfiles for your GitHub Actions workflows.
1The Risk of Mutable Tags
GitHub Actions are fetched from Git, making them vulnerable to supply-chain attacks if you rely on mutable tags. Attackers can point a previously safe tag at malicious code, compromising your pipeline. Previously, the standard advice was to pin actions to a full SHA hash to ensure immutability and prevent unauthorized code execution.
2Introducing Action Lockfiles
The gh-actions-lock extension for the GitHub CLI provides a robust solution for managing dependencies. By running the extension, you generate an actions.lock file that maps tags to specific commit SHAs. This approach allows you to use readable version tags in your YAML files while maintaining the security benefits of cryptographic pinning.
3Implementing the Lockfile
To start, install the extension using the command gh extension install github/gh-actions-lock. Once installed, execute gh actions-lock within your repository to validate workflows and create the lockfile. This process automatically updates your workflow files to use version tags, while the generated lockfile stores the precise commit hashes for every dependency.
4Verifying Integrity in CI
GitHub recommends verifying your lockfiles during CI to ensure they remain synchronized and uncorrupted. You can add a dedicated job to your workflow using the ubuntu-slim runner to execute gh actions-lock --verify. This parallel job ensures that any manual changes to workflows are immediately caught if they deviate from the lockfile.
5Managing Workflow Updates
Whenever you modify your workflow files or add new actions, you must run the lock command again to update the lockfile. The CI process will notify you if your configuration is out of sync. Remember to commit both the modified workflow files and the updated actions.lock file to your repository after every change.
6Security Linter Integration
Zizmor is a security linter specifically designed for GitHub Actions and is highly recommended for identifying vulnerabilities. Starting with version v1.32.0, Zizmor provides native support for lockfiles. You should update your pre-commit configuration to use this version to ensure your workflow security practices align with modern standards and best practices.
7Operational Considerations
When setting up the verification job, pinning the extension version itself, such as v0.4.1, is necessary for stability. While this requires manual updates in the future, it ensures consistent behavior across your CI environment. Using lightweight runners like ubuntu-slim helps keep your verification jobs efficient and minimizes resource consumption during the pipeline execution.
8Long-term Security Strategy
Adopting lockfiles represents a shift toward more deterministic CI/CD pipelines. By combining automated locking with security linting tools like Zizmor, developers can significantly reduce the attack surface of their automation. This layered approach ensures that your infrastructure remains resilient against malicious actors attempting to inject unauthorized code through compromised action tags.
Original article: Hacker News: Front Page — Securing GitHub Actions with Automated Lockfiles