Feature request: allow selected action owners to be explicitly excluded from lockfile pinning

Aperta
  • Qualcosa non va?
#194 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
45/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
github-actions, go
Ambito
cli, security

Direzione di ricerca

Start by tracing how gh actions-lock resolves workflow refs, reports findings such as self-repository-action, and verifies lockfile entries; then inspect runtime enforcement and lockfile parsing. The issue names no source files or tests, so locate those entry points first. Done means exclusions are recorded with reasons in the lockfile, reported during resolution, and treated as compliant by verification and enforcement only when listed.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

feature-request

Problem

Our workflows mix public GitHub-maintained actions with internal actions published by our own organization, e.g.:

steps:
  - uses: actions/checkout@v7
  - uses: internal-action/build-image@v1

We want SHA-locked integrity for third-party/public actions (actions/*), but our internal actions are deliberately consumed via a floating major tag (@v1). They are released frequently under our own access controls and review process, and we want consumers to pick up patch releases without a lockfile change for every internal release.

Today gh actions-lock has no way to exclude specific actions or owners. Because enforcement requires every dependency of an onboarded workflow to be present in actions.lock, our only options are:

  1. Lock internal actions too and run --relock constantly (heavy churn for every internal release), or
  2. Leave the whole workflow un-onboarded, losing protection for the public actions as well.

Neither is a good fit. Option 2 in particular pushes teams to skip locking entirely.

Proposal

Support an explicit, auditable exclusion recorded in the lockfile itself (not only as a CLI flag), so the runtime can tell "intentionally unlocked" apart from "missing":

# .github/workflows/actions.lock
unlocked:
  - owner: internal-action        # or a pattern like 'my-org/*'
    reason: 'Internal actions, governed by org release process'

Suggested behavior:

  • gh actions-lock skips resolution for matching refs and reports them as an informational finding (similar to self-repository-action), never silently.
  • --verify / --verify-local treat matching refs as compliant only if they are listed under unlocked.
  • Runtime enforcement accepts listed refs unpinned and still requires everything else to be locked.
  • Optionally, restrict eligible owners (e.g. same owner/org as the repository, or an org-level policy) so this can't be used to unlock arbitrary third-party actions.
Lingua principale
Go
Stelle
253
Fork
15
Merge medio
19h 30m
PR unite (30g)
60

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di github/gh-actions-lock

Tutte le issue di github/gh-actions-lock

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.