gh-actions-lock 0.2.0

Upgrade notes

• Lockfile schema is now v0.0.3. The first write after upgrading changes the version: line in your lockfile. This happens once.
• --verify is stricter. It now fails on lockfile entries that no workflow uses, and on workflows that have no lockfile entry. To fix this, run gh actions-lock once and commit the result.
• --verify-local never writes. Local ./ refs are now reported as findings. They are no longer migrated on disk.
• New GH_ACTIONS_LOCK_REPO_ROOT environment variable. Set it to the repository root when you relock a partial checkout that has no .git directory.
• --rescan is removed. Runs are now sticky: existing pins are kept, checked for parity with what the runner resolves, and followed through repository renames.

What's Changed

• Reject expressions in uses: in #99
• Narrow remote refs inside $/ actions, and stop transitive pins vetoing narrowing in #100
• Warn when workflows use mutable Docker image tags in #102
• Remove misleading lockfile lint checks in #103
• Prune removed dependencies during scoped runs in #105
• cooldown: use dependabot config in #104
• Add guarded release tooling and release candidates in #106
• Document RC preview and failed publish recovery in #107
• Simplify failed publish recovery guidance in #108
• Stop adding management comments to workflows in #115
• Only rewrite action refs to tags at the resolved commit in #117
• Pinning: repair SHA refs from existing lock metadata in #116
• Support hostname-aware lockfiles for data residency in #137
• Add --version to test in package managers in #135
• Record dependency-free workflows in the lockfile in #124
• Match direct uses case-insensitively on owner/repo in #147
• Replace --rescan with sticky locks and runner-parity checks in #145
• Replace the resolution record with a --json run log in #142
• Write nothing when a run has blocking errors in #150
• Report rolled-back runs honestly when actions can't be resolved in #152
• Block on missing refs and commits, and say how to fix them in #153
• Fail closed under the Dependabot proxy in #154
• Rename the repo-hijacked finding category to repo-replaced in #155
• Check mutable-ref pins against ref history under --verify in #156
• Return the context error when cancelled during parity in #157
• verify-local: report ./ refs instead of migrating them on disk in #158
• workflowfile: honour GH_ACTIONS_LOCK_REPO_ROOT for repo root discovery in #160
• docs: update README release stage to public preview in #162
• checks: report unused lockfile entries and untracked workflows as errors in #159

Full Changelog: v0.1.6...v0.2.0