Lock Your GitHub Actions

GitHub Actions now supports workflow lockfiles to enhance security by preventing supply-chain attacks through mutable tags. Users can install the `gh-actions-lock` extension to automatically convert tag-based action references to version tags while generating a lockfile that maps them to their exact commit SHAs. Both Renovate and Dependabot already support automatic lockfile updates, and GitHub recommends validating lockfiles in CI to ensure they remain up-to-date and uncorrupted.