Verified facts
- The gh actions-lock extension generates .github/workflows/actions.lock with actions, transitive dependencies and reusable workflows.
- Adoption can proceed workflow by workflow; once onboarded, every dependency needs an entry and runs at the locked commit.
- A Require lockfile policy can enforce the mechanism; Dependabot regenerates entries during updates. Free, Team and Enterprise Cloud, including data residency, are covered by the preview.
What changes
Commit review remains meaningful even if tags move later.
Practical implication
Pilot on one workflow and add a stale-lockfile check in CI.
Availability
Belgium/EEA: the source specifies no explicit regional exclusion; availability depends on the account, plan and service region.
Limits and uncertainty
Locking a dependency prevents a moving tag from changing executed code; it does not prove the locked commit is safe.