GitHub Actions Workflow Lockfiles: Pin Every Action With gh actions-lock and Enforce It A line like uses: actions/checkout@v7 does not name a piece of code. It names a tag, and the owner of that repository can point the tag at a different commit whenever they like. When we resolved it on October 15, 2026, …

GitHub Actions' New vulnerability-alerts Permission: Read Dependabot Alerts Without a PAT If you've ever tried to have a GitHub Actions workflow check for open Dependabot alerts — to block a release, gate a merge, or post a Slack summary — you've probably hit a wall: the default GITHUB_TOKEN can't read them. The …