Feature request: Add support for `gh actions-lock --verify owner/repo@ref`

Open
  • Is something wrong?
#164 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
github-actions, go
Domain
cli, security

Research direction

The request is to let gh actions-lock --verify owner/repo@ref check a remote repository's lockfile without cloning it. The issue names no files, so start from the existing --verify code path in this Go CLI and decide how a remote lockfile would be fetched. Design choices, such as which GitHub API to use, are still open. Done means a remote verify works with a test covering a pinned ref.

Written by the indexing model from the issue text.

Description

area:cli feature-request

For verifying callable workflows it would be nice if actions-lock could verify a remote lockfile without having to clone every repo.

I can't run  gh actions-lock --verify  on a remote repo, so that remote lock file is trusted without verification

Dominant language
Go
Stars
253
Forks
15
Avg merge
19h 30m
Merged PRs (30d)
60

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-actions-lock

All issues in github/gh-actions-lock

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.