gh-actions-lock 0.2.0

Upgrade notes

• Lockfile schema is now v0.0.3. The first write after upgrading changes the version: line in your lockfile. This happens once.
• --verify is stricter. It now fails on lockfile entries that no workflow uses, and on workflows that have no lockfile entry. To fix this, run gh actions-lock once and commit the result.
• --verify-local never writes. Local ./ refs are now reported as findings. They are no longer migrated on disk.
• New GH_ACTIONS_LOCK_REPO_ROOT environment variable. Set it to the repository root when you relock a partial checkout that has no .git directory.
• --rescan is removed. Runs are now sticky: existing pins are kept, checked for parity with what the runner resolves, and followed through repository renames.

What's Changed

• Reject expressions in uses: in #99
• Narrow remote refs inside $/ actions, and stop transitive pins vetoing narrowing in #100
• Warn when workflows use mutable Docker image tags in #102
• Remove misleading lockfile lint checks in #103
• Prune removed dependencies during scoped runs in #105
• cooldown: use dependabot config in #104
• Add guarded release tooling and release candidates in #106
• Document RC preview and failed publish recovery in #107
• Simplify failed publish recovery guidance in #108
• Stop adding management comments to workflows in #115
• Only rewrite action refs to tags at the resolved commit in #117
• Pinning: repair SHA refs from existing lock metadata in #116
• Support hostname-aware lockfiles for data residency in #137
• Add --version to test in package managers in #135
• Record dependency-free workflows in the lockfile in #124
• Match direct uses case-insensitively on owner/repo in #147
• Replace --rescan with sticky locks and runner-parity checks in #145
• Replace the resolution record with a --json run log in #142
• Write nothing when a run has blocking errors in #150
• Report rolled-back runs honestly when actions can't be resolved in #152
• Block on missing refs and commits, and say how to fix them in #153
• Fail closed under the Dependabot proxy in #154
• Rename the repo-hijacked finding category to repo-replaced in #155
• Check mutable-ref pins against ref history under --verify in #156
• Return the context error when cancelled during parity in #157
• verify-local: report ./ refs instead of migrating them on disk in #158
• workflowfile: honour GH_ACTIONS_LOCK_REPO_ROOT for repo root discovery in #160
• docs: update README release stage to public preview in #162
• checks: report unused lockfile entries and untracked workflows as errors in #159

Full Changelog: v0.1.6...v0.2.0

gh-actions-lock 0.2.0-rc.1

This is a release candidate for public preview. Install it with gh extension install github/gh-actions-lock --pin v0.2.0-rc.1.

Upgrade notes

• Lockfile schema is now v0.0.3. The first write after upgrading changes the version: line in your lockfile. This happens once.
• --verify is stricter. It now fails on lockfile entries that no workflow uses, and on workflows that have no lockfile entry. To fix this, run gh actions-lock once and commit the result.
• --verify-local never writes. Local ./ refs are now reported as findings. They are no longer migrated on disk.
• New GH_ACTIONS_LOCK_REPO_ROOT environment variable. Set it to the repository root when you relock a partial checkout that has no .git directory.
• --rescan is removed. Runs are now sticky: existing pins are kept, checked for parity with what the runner resolves, and followed through repository renames.

What's Changed

• Reject expressions in uses: in #99
• Narrow remote refs inside $/ actions, and stop transitive pins vetoing narrowing in #100
• Warn when workflows use mutable Docker image tags in #102
• Remove misleading lockfile lint checks in #103
• Prune removed dependencies during scoped runs in #105
• cooldown: use dependabot config in #104
• Add guarded release tooling and release candidates in #106
• Document RC preview and failed publish recovery in #107
• Simplify failed publish recovery guidance in #108
• Stop adding management comments to workflows in #115
• Only rewrite action refs to tags at the resolved commit in #117
• Pinning: repair SHA refs from existing lock metadata in #116
• Support hostname-aware lockfiles for data residency in #137
• Add --version to test in package managers in #135
• Record dependency-free workflows in the lockfile in #124
• Match direct uses case-insensitively on owner/repo in #147
• Replace --rescan with sticky locks and runner-parity checks in #145
• Replace the resolution record with a --json run log in #142
• Write nothing when a run has blocking errors in #150
• Report rolled-back runs honestly when actions can't be resolved in #152
• Block on missing refs and commits, and say how to fix them in #153
• Fail closed under the Dependabot proxy in #154
• Rename the repo-hijacked finding category to repo-replaced in #155
• Check mutable-ref pins against ref history under --verify in #156
• Return the context error when cancelled during parity in #157
• verify-local: report ./ refs instead of migrating them on disk in #158
• workflowfile: honour GH_ACTIONS_LOCK_REPO_ROOT for repo root discovery in #160
• docs: update README release stage to public preview in #162
• checks: report unused lockfile entries and untracked workflows as errors in #159

Full Changelog: v0.1.6...v0.2.0-rc.1

gh-actions-lock 0.1.7-rc.1

What's Changed

• Reject expressions in uses: by @nodeselector in #99
• Narrow remote refs inside $/ actions, and stop transitive pins vetoing narrowing by @nodeselector in #100
• Warn when workflows use mutable Docker image tags by @nodeselector in #102
• Remove misleading lockfile lint checks by @nodeselector in #103
• Prune removed dependencies during scoped runs by @nodeselector in #105
• cooldown: use dependabot config by @nodeselector in #104
• Add guarded release tooling and release candidates by @nodeselector in #106

Full Changelog: v0.1.6...v0.1.7-rc.1

gh-actions-lock 0.1.6

What's Changed

• Add SHA-pinned Dependency Review workflow by @nodeselector in #83
• Re-verify locked pins on the default run, and surface verify failures by @nodeselector in #85
• Switch to public package mirror by @nodeselector in #89
• Update warning message to 'Technical Preview' by @Steve-Glass in #90
• Support self-referencing $/ uses: syntax in the pin tool by @nodeselector in #84
• Add --relock to bump moved branch and version refs by @nodeselector in #88
• Prune deleted workflows from the lockfile on a full scan by @nodeselector in #87
• Make local-action migration default-on with a --no-migrate-local-actions opt-out by @nodeselector in #92
• Don't count about-to-be-pinned workflows as failed by @nodeselector in #86
• Skip branch scans for symbolic action refs by @nodeselector in #93
• Support hosted Dependabot through REST-only GitHub API access by @nodeselector in #94
• Support sequential release candidate tags by @nodeselector in #95
• Require manually pushed release tags by @nodeselector in #97

New Contributors

• @Steve-Glass made their first contribution in #90

Full Changelog: https://github.com/github/gh-actions-lock/commits/v0.1.6

gh-actions-lock 0.1.6-rc.2

What's Changed

• Add SHA-pinned Dependency Review workflow by @nodeselector in #83
• Re-verify locked pins on the default run, and surface verify failures by @nodeselector in #85
• Switch to public package mirror by @nodeselector in #89
• Update warning message to 'Technical Preview' by @Steve-Glass in #90
• Support self-referencing $/ uses: syntax in the pin tool by @nodeselector in #84
• Add --relock to bump moved branch and version refs by @nodeselector in #88
• Prune deleted workflows from the lockfile on a full scan by @nodeselector in #87
• Make local-action migration default-on with a --no-migrate-local-actions opt-out by @nodeselector in #92
• Don't count about-to-be-pinned workflows as failed by @nodeselector in #86
• Skip branch scans for symbolic action refs by @nodeselector in #93
• Support hosted Dependabot through REST-only GitHub API access by @nodeselector in #94
• Support sequential release candidate tags by @nodeselector in #95

New Contributors

• @Steve-Glass made their first contribution in #90

Full Changelog: https://github.com/github/gh-actions-lock/commits/v0.1.6-rc.2

gh-actions-lock 0.1.5

What's Changed

• Fall back to anonymous REST when SSO blocks actions/* resolution by @nodeselector in #75

Full Changelog: v0.1.4...v0.1.5

gh-actions-lock 0.1.4

What's Changed

• Block composite local paths and detect transitive ref-moved by @nodeselector in #73
• Remove hosted/self-hosted runner restrictions by @nodeselector in #74

Full Changelog: v0.1.3...v0.1.4

gh-actions-lock 0.1.3

What's Changed

• SSO: replace browser URL with actionable fix guidance by @nodeselector in #68
• --no-narrow skips bare-SHA to tag rewriting by @nodeselector in #69

Full Changelog: v0.1.1...v0.1.3

gh-actions-lock 0.1.2

What's Changed

• Add reusable relock workflow for Dependabot PRs by @nodeselector in #63
• lint action: build from source with goproxy by @nodeselector in #64
• relock: convert to composite action, build from source by @nodeselector in #65
• relock: regenerate lockfile, fix test.yml permissions by @nodeselector in #66
• Allow --allow-all-runners to cover expression-based runs-on labels by @nodeselector in #67

Full Changelog: v0.1.0...v0.1.2

gh-actions-lock 0.1.0

What's Changed

• Filter matrix expressions from runner label warnings by @nodeselector in #59
• Update README.md by @nodeselector in #57
• pin summary: deduplicate impostor-commit output by @nodeselector in #60
• Add sentinel comment to managed workflow files by @nodeselector in #61
• lockfile: bump parser to v0.0.2 with simplified pin keys by @nodeselector in #62

Full Changelog: v0.0.16...v0.1.0