[renovate]

This PR contains the following updates:

Package	Update	Change
github/gh-actions-lock	minor	v0.2.0 → v0.4.0

---

Release Notes

github/gh-actions-lock

v0.4.0: gh-actions-lock 0.4.0

Compare Source

What's Changed

• Update RELEASING.md for v0.3.0 by @​nodeselector in #​240
• README: clarify --verify-local is coverage only by @​nodeselector in #​241
• Authenticate public github.com lookups on GHE.com by @​nodeselector in #​244

Full Changelog: github/gh-actions-lock@v0.3.0...v0.4.0

v0.3.0: gh-actions-lock 0.3.0

Compare Source

Upgrade notes

The lockfile schema is unchanged (v0.0.3). Some lockfiles that passed --verify on v0.2.0 now fail it; each case below says how to fix it.

Breaking / behavior changes

• Local ./ actions that use remote actions now block fix and verify runs by default. ./ actions are never followed or locked. Use --migrate-local-actions to rewrite them to $/, or --ignore-local-actions to keep them as a warning. (#​219)
• New --json finding categories: ref-missing and invalid-workflow. Both used to be reported as not-pinned. Both still block with exit 1. (#​232)
• Fix-mode --json reports the post-fix state, not the state before the fix. (#​232)
• A full-SHA lock entry whose ref is that same SHA now fails --verify and --verify-local as not-pinned, instead of failing the load. A plain gh actions-lock run repairs it. (#​198, #​215)
• Older lockfiles can fail --verify with incomplete-lockfile. Run gh actions-lock --relock and commit the result. (#​212, #​214)
• Full-SHA pins to fork-only (impostor) commits are rejected. Every locked commit must be in the history of its recorded tag or branch. Refs shaped like Git revision syntax (main~1) or git describe output are rejected too. Thanks to @​fproulx-boostsecurity for reporting it in #​174. (#​186)
• An exact tag locked behind its commit is a tag-commit-mismatch error. Fix with --relock. (#​208, #​221)
• Pins GitHub didn't answer for are retryable errors (exit 1, "retryable": true) instead of passing. (#​209)
• Moved floating refs stay locked in fix runs with a non-blocking ref-moved warning. --relock and --accept-moved still re-pin them. (#​227)
• Fix runs never write a lockfile their own verify rejects. A run refuses to write a uses: cycle or an incomplete lock graph. (#​214, #​230, #​231)

New

• container-image warnings for images the lockfile can't pin: docker:// steps, job container: and services:, and remote Docker actions. (#​220, #​222)
• Fresh-tag warnings when a cooldown is configured, using the cooldown as the freshness window. (#​224)
• Every finding's doc_url links its section in docs/troubleshooting.md. (#​225)
• A sample workflow that runs gh actions-lock --verify in CI: .github/workflows/verify-lockfile.yml. (#​233)
• An agent skill: gh skill install github/gh-actions-lock. (#​234)
• Online checks of recorded pins run concurrently in small batches, so the new checks keep --verify about as fast as v0.2.0, and a spinner shows progress from the start. (#​239)
• Patient retries under the Dependabot proxy, and bounded, classified GitHub API retries everywhere. (#​207, #​226)

Fixed

• Actions inside parallel: step groups are now locked. (#​176)
• SHA-to-branch normalization no longer fails with conflicting planned target. (#​165, #​167)
• Full SHAs are written one way (lowercase) in the lockfile. (#​213)
• Lockfiles that record a tag containing @ load again. (#​217)
• --migrate-local-actions no longer aborts on an unparseable workflow. (#​229)
• Read-only checks skip cooldown diagnostics. (#​204)
• Terminal errors keep SSO guidance. (#​203)

Docs

• The README is shorter and adds a Limitations section. (#​235)
• The troubleshooting doc explains impostor commits under unreachable-pin. (#​237)

Thanks

• @​bayandin fixed SHA-to-branch normalization in #​165 and #​167.
• @​jessehouwing locked parallel: step groups in #​176, fixed Windows tests in #​177, and enforced LF line endings in #​181, and reported the local-action issues #​111, #​123 and #​128.
• @​fproulx-boostsecurity reported the impostor-commit gap in #​174.
• @​Adam-S-Daniel reported unverifiable pins passing in #​199 and exact tags locked behind their commit in #​202.
• @​ccjernigan reported the missing parallel: steps in #​175.
• @​CyberNativeAI asked for container-image warnings in #​168.

Full Changelog: github/gh-actions-lock@v0.2.0...v0.3.0

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 06:59 PM, Monday through Friday (* 9-18 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.