Pinning uses in workflow YAML isn't enough; your CI still pulls transitive…

Pinning uses in workflow YAML isn't enough; your CI still pulls transitive, mutable action code at run time. GitHub's workflow dependency lockfile pins every action and its transitive dependencies to a commit SHA, turning behind-the-scenes supply-chain movement into something reviewable and reproducible. If you let bots or teammates edit workflows to speed changes, add actions.lock and gate updates through code review so CI churn becomes a recorded, auditable change rather than invisible drift.