GitHub Actions workflow lockfiles aim to make action dependencies immutable, but discussion notes they currently cover only normal action calls—not reusable workflows, Docker-based uses clauses, or composite actions themselves—and can weaken transitive pinning by removing hashes. Commenters welcomed the long-awaited feature as an improvement over manual SHA pinning while warning that fully locked setups can still run mutable or compromised code unless lockfiles are verified in CI. Some argued GitHub should enforce immutable tags or handle immutability at the platform level.