A lockfile pins every action your workflows depend on to a verified commit, so the code you reviewed is the code that runs.