GitHub Actions Workflow Lockfiles: Pin Every Action With gh actions-lock and Enforce It A line like uses: actions/checkout@v7 does not name a piece of code. It names a tag, and the owner of that repository can point the tag at a different commit whenever they like. When we resolved it on October 15, 2026, …