---
title: "Discussion on \"How GitHub Actions Workflow Lockfiles Work\" | Hashnode"
description: "Discussion on \"How GitHub Actions Workflow Lockfiles Work\". Most workflows pin actions to a version tag: uses: actions/checkout@v4. It reads like a fixed version. It isn't. A tag is a movable label, and whoever controls the action's repository can move it. Usu"
url: "https://hashnode.com/posts/how-github-actions-workflow-lockfiles-work/6af1677907e41a286a297735"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [How GitHub Actions Workflow Lockfiles Work](https://aheadkit.hashnode.dev/how-github-actions-workflow-lockfiles-work?utm_source=hashnode&utm_medium=feed)

Most workflows pin actions to a version tag: uses: actions/checkout@v4. It reads like a fixed version. It isn't. A tag is a movable label, and whoever controls the action's repository can move it. Usu

1d ago · 5 min read · aheadkit.hashnode.dev  
Updated 1h ago  
Read the article

-   [#githubactions](https://hashnode.com/tag/githubactions)
-   [#cicd](https://hashnode.com/tag/cicd)
-   [#security](https://hashnode.com/tag/security)
-   [#devops](https://hashnode.com/tag/devops)

## Written by

[Abdus Salam](https://hashnode.com/@aheadkit)

@aheadkit

  
[View profile](https://hashnode.com/@aheadkit)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.