Your CI pipeline needs a lockfile, too

Lockfiles might be familiar to you if you’ve ever worked with package managers like npm or Yarn (for the JavaScript ecosystem) or Composer (for the PHP ecosystem). A lockfile, as the name suggests, is a data file generated by these package managers that “locks in” or, in other words, records exact dependency versions, cryptographic hashes, or resource-access states. And since lockfiles pin the exact versions and transitive dependencies of libraries, it guarantees that every developer or CI/CD server installs the exact same code. The workflow becomes reproducible. And so, we are sorted when it comes to making the workflow consistent on the application or its build level. However, one important part of the software supply chain has largely lacked this capability: CI/CD workflows. That changed recently with the general availability of workflow dependency lockfiles for GitHub Actions. The GitHub Actions workflow that builds, tests, and deploys applications can itself depend on executable…