gh-actions-lock 0.3.0

Upgrade notes

The lockfile schema is unchanged (v0.0.3). Some lockfiles that passed --verify on v0.2.0 now fail it; each case below says how to fix it.

Breaking / behavior changes

• Local ./ actions that use remote actions now block fix and verify runs by default. ./ actions are never followed or locked. Use --migrate-local-actions to rewrite them to $/, or --ignore-local-actions to keep them as a warning. (#219)
• New --json finding categories: ref-missing and invalid-workflow. Both used to be reported as not-pinned. Both still block with exit 1. (#232)
• Fix-mode --json reports the post-fix state, not the state before the fix. (#232)
• A full-SHA lock entry whose ref is that same SHA now fails --verify and --verify-local as not-pinned, instead of failing the load. A plain gh actions-lock run repairs it. (#198, #215)
• Older lockfiles can fail --verify with incomplete-lockfile. Run gh actions-lock --relock and commit the result. (#212, #214)
• Full-SHA pins to fork-only (impostor) commits are rejected. Every locked commit must be in the history of its recorded tag or branch. Refs shaped like Git revision syntax (main~1) or git describe output are rejected too. Thanks to @fproulx-boostsecurity for reporting it in #174. (#186)
• An exact tag locked behind its commit is a tag-commit-mismatch error. Fix with --relock. (#208, #221)
• Pins GitHub didn't answer for are retryable errors (exit 1, "retryable": true) instead of passing. (#209)
• Moved floating refs stay locked in fix runs with a non-blocking ref-moved warning. --relock and --accept-moved still re-pin them. (#227)
• Fix runs never write a lockfile their own verify rejects. A run refuses to write a uses: cycle or an incomplete lock graph. (#214, #230, #231)

New

• container-image warnings for images the lockfile can't pin: docker:// steps, job container: and services:, and remote Docker actions. (#220, #222)
• Fresh-tag warnings when a cooldown is configured, using the cooldown as the freshness window. (#224)
• Every finding's doc_url links its section in docs/troubleshooting.md. (#225)
• A sample workflow that runs gh actions-lock --verify in CI: .github/workflows/verify-lockfile.yml. (#233)
• An agent skill: gh skill install github/gh-actions-lock. (#234)
• Online checks of recorded pins run concurrently in small batches, so the new checks keep --verify about as fast as v0.2.0, and a spinner shows progress from the start. (#239)
• Patient retries under the Dependabot proxy, and bounded, classified GitHub API retries everywhere. (#207, #226)

Fixed

• Actions inside parallel: step groups are now locked. (#176)
• SHA-to-branch normalization no longer fails with conflicting planned target. (#165, #167)
• Full SHAs are written one way (lowercase) in the lockfile. (#213)
• Lockfiles that record a tag containing @ load again. (#217)
• --migrate-local-actions no longer aborts on an unparseable workflow. (#229)
• Read-only checks skip cooldown diagnostics. (#204)
• Terminal errors keep SSO guidance. (#203)

Docs

• The README is shorter and adds a Limitations section. (#235)
• The troubleshooting doc explains impostor commits under unreachable-pin. (#237)

Thanks

• @bayandin fixed SHA-to-branch normalization in #165 and #167.
• @jessehouwing locked parallel: step groups in #176, fixed Windows tests in #177, and enforced LF line endings in #181, and reported the local-action issues #111, #123 and #128.
• @fproulx-boostsecurity reported the impostor-commit gap in #174.
• @Adam-S-Daniel reported unverifiable pins passing in #199 and exact tags locked behind their commit in #202.
• @ccjernigan reported the missing parallel: steps in #175.
• @CyberNativeAI asked for container-image warnings in #168.

Full Changelog: v0.2.0...v0.3.0