Feature request: minimum release age (cooldown) for resolved pins

オープン
  • 何か問題がありますか？
#132 コメント 3 件 リアクション 2 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
35/100
issue の種類
機能追加
明瞭さ
説明が足りない
活発さ
活発
技術スタック
github-actions, go
領域
cli, security

調査の方向性

Start by tracing the entry points for gh actions-lock, --relock, --verify, and --no-fix, focusing on how actions.lock references are resolved and checked. Compare the proposed --min-age behavior across initial pinning, relocking, ref narrowing, and verification, then clarify the fallback and configuration semantics before implementation.

索引モデルが issue の本文から書いたものです。

説明

area:cli feature-request

Summary

Add an option to exclude releases published less than N days ago when resolving action references into lockfile pins — the same "cooldown" concept as pinact's -min-age, Dependabot's cooldown, or the npm ecosystem's minimumReleaseAge settings, applied to actions.lock.

Motivation

  • Avoiding freshly-published releases is one of the cheapest supply-chain defenses. Recent research found that most compromised packages are detected and removed within about a week of publication (see https://nesbitt.io/2026/03/04/package-managers-need-to-cool-down.html), so simply not adopting versions younger than a few days moves consumers out of the blast window.
  • Automated update paths already have workarounds: tools like Renovate (minimumReleaseAge) and Dependabot (cooldown) can gate their own update proposals.
  • But when a maintainer runs gh actions-lock or gh actions-lock --relock manually, the tool always resolves the current latest SHA. There is no substitute on this path — unless the tool itself offers an age gate, manual relocking can pull in a release published minutes ago.

Prior art

  • Dependabot cooldown (default-days, semver-*-days): version updates wait out a cooldown by default (3 days); security updates bypass it. Same vendor, same problem space.
  • npm ecosystem: npm CLI min-release-age, pnpm minimumReleaseAge (on by default since pnpm 11), Yarn npmMinimalAgeGate, Bun install.minimumReleaseAge.
  • pinact -min-age / --verify-min-age: the direct predecessor for pinning GitHub Actions; filters candidate versions by tag commit date / release publish date, and can verify existing pins against the same floor.
  • action-locker --min-age-days: a third-party lockfile tool with the same feature, including a fallback mode that walks back to the newest release that clears the age floor instead of hard-failing.
  • Renovate minimumReleaseAge: feasible here because GitHub tag/release lookups expose release timestamps — the same data sources actions.lock resolution already touches.

Proposed semantics (strawman)

  • A --min-age <duration> flag and/or a lockfile/config field.
  • Applied wherever a version is selected: initial pinning, --relock, and ref narrowing (e.g. @v4 resolves to the newest v4.x.y tag that clears the age floor).
  • When no version satisfies the window: either fail-closed with a clear error, or fall back to the newest release that does (action-locker style) — open to maintainer preference.
  • --verify / --no-fix could additionally flag pins younger than the window (the pinact --verify-min-age equivalent), so CI can enforce the policy without restricting manual runs.

Notes

  • Checked gh actions-lock --help (v0.1.6): no age-related option exists.
  • I couldn't find an existing issue or discussion covering this (searched this repo's issues, github/actions-lockfile, cli/cli RFC #13314, and github/roadmap).
主要言語
Go
スター
295
フォーク
21
平均マージ
19時間 30分
マージ済み PR（30日）
60

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

github/gh-actions-lock のほかの issue

github/gh-actions-lock の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。