GitHub Actions workflow lockfiles 公开预览：锁定依赖防篡改
GitHub Actions workflow lockfiles in public preview
这是 CI/CD 安全能力的重大跃迁。对于重度依赖 GitHub Actions 的团队，引入依赖锁定是防御供应链攻击的关键一步。建议立即安装 gh actions-lock 扩展并在测试环境中试用，评估是否需要在组织层面强制推行 Require lockfile 策略以消除上游依赖漂移风险。
GitHub Actions workflow dependency lockfiles are now in public preview for GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency. Tags and branches can move after you review a workflow, so a later run might execute different code. Lockfiles let you keep those references in your workflow while running the exact commits you locked.
GitHub Actions 工作流依赖项锁定文件现已在 GitHub Enterprise Cloud 和具有数据驻留功能的 GitHub Enterprise Cloud 中公开预览。在工作流审核完成后，标签和分支可能会移动，因此后续运行可能会执行不同的代码。锁定文件允许你在保持工作流引用的同时，运行你锁定的确切提交。
If an action is compromised, a moved tag or branch can introduce malicious code into your workflow without a change to your repository. Lockfiles help protect against unexpected dependency changes by keeping workflow runs tied to the commits you locked. Locking does not determine whether the dependency itself is safe, so review dependencies before locking them.
如果某个操作被攻破，移动的标签或分支可能会在不更改仓库的情况下将恶意代码引入你的工作流。锁定文件通过将工作流运行与你锁定的提交绑定，帮助防范意外的依赖项变更。锁定并不能决定依赖项本身是否安全，因此在锁定之前请审查依赖项。
Install the gh actions-lock extension for the GitHub CLI to create and maintain your workflow lockfile. With the extension, you can:
安装 GitHub CLI 的 gh actions-lock 扩展以创建和维护你的工作流锁定文件。使用该扩展，你可以：
- Pin your dependencies: Generate .github/workflows/actions.lock with reviewable commits for actions and their transitive dependencies, as well as reusable workflow dependencies.
- Adopt locking gradually: Onboard workflows individually. Once onboarded, a workflow must have lockfile entries for its dependencies, and GitHub Actions runs the recorded commits.
- Keep workflow runs consistent: GitHub Actions requires each dependency of an onboarded workflow to be in the lockfile and uses its recorded commit, even if a tag or branch moves.
- Check for stale lockfiles: Verify that the lockfile is up to date without modifying files, including in a CI check.
- 固定你的依赖项：生成 .github/workflows/actions.lock，其中包含可审查的操作及其传递依赖项以及可重用工作流依赖项的提交。
- 逐步采用锁定：逐个对工作流进行上线。一旦上线，工作流必须为其依赖项拥有锁定文件条目，并且 GitHub Actions 会运行记录的提交。
- 保持工作流运行的一致性：GitHub Actions 要求已上线工作流的每个依赖项都存在于锁定文件中，并使用其记录的提交，即使标签或分支发生移动也是如此。
- 检查过期的锁定文件：验证锁定文件是否为最新状态，而无需修改文件，包括在 CI 检查中。
The Require lockfile policy is also available in public preview. Enterprise, organization, and repository administrators can require workflows to use lockfiles across their enterprise, organization, or repository.
“要求使用锁定文件”策略也已在公开预览中提供。企业、组织和仓库管理员可以要求其企业、组织或仓库中的工作流使用锁定文件。
Keep locked dependencies up to date with Dependabot
使用 Dependabot 保持锁定依赖项的最新状态
Dependabot helps you keep your GitHub Actions dependencies up to date. When it opens a version update for an action in a workflow that is already onboarded, it also regenerates the matching lockfile entry in the same pull request, keeping the updated workflow reference and its locked commit in sync without additional configuration. Read more about Dependabot updates for actions.
Dependabot 帮助你保持 GitHub Actions 依赖项的最新状态。当它为已上线工作流中的操作打开版本更新时，它还会在同一拉取请求中重新生成匹配的锁定文件条目，使更新后的工作流引用与其锁定的提交保持同步，无需额外配置。了解更多关于 Dependabot 对操作的更新信息。
Get started
开始使用
To get started, install the extension from the public gh-actions-lock repository, then review and commit the generated lockfile and workflow changes.
要开始使用，请从公开的 gh-actions-lock 仓库安装该扩展，然后审查并提交生成的锁定文件和工作流更改。
For more details and links to setup instructions, see workflow dependency lockfiles in GitHub Docs.
更多详细信息和设置说明链接，请参阅 GitHub Docs 中的工作流依赖项锁定文件。
Share feedback in the existing community discussion or open an issue in the gh-actions-lock repository.
在现有的社区讨论中分享反馈，或在 gh-actions-lock 仓库中提出问题。
Thank you to the community members who helped shape this preview through testing and feedback, with special thanks to Andrew Nesbitt, François Proulx, Jesse Houwing, and William Woodruff for their close collaboration and iteration on this solution over the past year.
感谢通过测试和反馈帮助塑造此预览版的社区成员，特别感谢 Andrew Nesbitt、François Proulx、Jesse Houwing 和 William Woodruff 在过去一年中对此方案的紧密协作与迭代。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力