Bug: Modifying `owner_id` in a lockfile does not cause a validation failure

Open
  • Is something wrong?
#211 2 comments 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 1 day

@jay23606 is already working on this.

Since Oct 22, 2026.

  • #228 by @jay23606 — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
57/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
github-actions, go
Domain
cli, security

Research direction

Start by tracing how the lockfile verifier validates an action reference and its owner_id; the issue does not name a source file or test. Use the linked MRE as the reproduction: change owner_id and run the verification command. Done when the incorrect identifier causes a validation failure.

Written by the indexing model from the issue text.

Description

area:cli bug

I noticed this while trying random things out with a lockfile: if owner_id is perturbed, it doesn't cause a validation failure (despite no longer being the correct owner identifier for the action reference).

(I think my expected behavior here is a hard failure, since the lockfile is invalid.)

MRE here: https://github.com/woodruffw-experiments/actions-lockfile-experiments/pull/2

Dominant language
Go
Stars
253
Forks
15
Avg merge
19h 30m
Merged PRs (30d)
60

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-actions-lock

All issues in github/gh-actions-lock

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.